CVE-2026-74033: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wazuh wazuh-manager

Wazuh wazuh-manager versions >=4.1.1 and <4.14.8 contain a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers. This flaw allows attackers with compromised cluster worker privileges to send specially crafted traversal or absolute-path filenames via the internal cluster RPC path, bypassing REST API validation and role-based access control (RBAC). As a result, attackers can read or delete critical master files, including the rbac.db file, which could impact the integrity and security of the system.

An attacker who has compromised cluster worker privileges can exploit this vulnerability to read or delete sensitive master files on the wazuh-manager, including the RBAC database file (rbac.db). This could lead to unauthorized modification or removal of access control configurations, potentially undermining the security posture of the Wazuh deployment. The vulnerability requires high privileges (PR:H) but does not require user interaction and has a high impact on confidentiality and integrity.

The vulnerability affects wazuh-manager versions from 4.1.1 up to but not including 4.14.8. Users should upgrade to version 4.14.8 or later where this issue is fixed. Since no vendor advisory or patch link is provided in the input, confirm patch availability and upgrade instructions from the official Wazuh vendor advisory or release notes before applying updates.