CVE-2026-93347

EUVD-2026-98682
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 25.65%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
wazuhwazuh
4.1.1 ≤
𝑥
< 4.14.8
CNA
Common Weakness Enumeration
References
https://github.com/wazuh/wazuh/releases/tag/v4.14.8
https://github.com/wazuh/wazuh/security/advisories/GHSA-xrjw-cqrv-j92g
https://www.vulncheck.com/advisories/wazuh-4.1.1-before-4.14.8-path-traversal-via-cluster-get-list-file
https://github.com/wazuh/wazuh/security/advisories/GHSA-xrjw-cqrv-j92g