CVE-2026-74043: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wazuh wazuh-manager
Description
Wazuh wazuh-manager versions from 4.1.1 up to but not including 4.14.8 contain a path traversal vulnerability. This flaw allows malicious cluster workers with cluster key access to write files to arbitrary filesystem locations by sending specially crafted DistributedAPI requests that bypass REST controller validation. The vulnerability affects the upload_list_file, upload_rule_file, and upload_decoder_file functions. The issue is exploitable by authenticated users with high privileges within the cluster.
CVSS v4.0
Score 8.5high
Affected software
Wazuh
wazuh-manager
pkg:github/wazuh-managerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-74043 is a path traversal vulnerability in Wazuh wazuh-manager affecting versions >=4.1.1 and <4.14.8. Malicious cluster workers possessing the cluster key can exploit this vulnerability by sending DistributedAPI requests containing '../' sequences in filenames to the upload_list_file, upload_rule_file, and upload_decoder_file endpoints. This bypasses REST controller validation and allows writing files as the wazuh user to arbitrary paths on the filesystem.
Potential Impact
An attacker with cluster key privileges can write files to arbitrary locations on the system running wazuh-manager. This could lead to unauthorized file modification or code execution under the wazuh user context, potentially compromising the integrity and security of the affected system.
Mitigation Recommendations
The vulnerability affects versions from 4.1.1 up to but excluding 4.14.8. Users should upgrade to version 4.14.8 or later where this issue is fixed. No vendor advisory content was provided, so patch status is inferred from the version range. Patch status is confirmed by the version range indicating fixed in 4.14.8. No additional mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-14T14:06:40.513Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace36e32cdf04f65668a6cf
Added to database: 10/13/2026, 13:49:23 UTC
Last enriched: 10/13/2026, 14:03:32 UTC
Last updated: 10/13/2026, 14:04:19 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.