A flaw in the cluster file synchronization process allows an entity possessing the cluster key to write, overwrite, or delete arbitrary files within the `/var/ossec` directory on worker nodes, potentially resulting in remote code execution with root privileges. The issue occurs in the non-merged branch of the `update master files in worker()` function, where files are moved to a destination using `safe join()`. While this confines the path to `/var/ossec`, the system fails to verify if the file is placed in the directory specified by its `cluster item key`. This lack of destination verification, which is present on the primary node and the worker's merged branch, allows a peer to place files in attacker-controlled locations within `/var/ossec` that are executed as root. The delete branch contains the same deficiency.