CVE-2026-74031

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.1.1 through 4.14.7

Description A path traversal issue exists in the delete rule file and delete decoder file helpers. This allows malicious cluster workers possessing the cluster key to delete arbitrary files, such as ossec.conf, client.keys, or rules, by sending traversal sequences through the DistributedAPI via an unvalidated filename parameter. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

Recommendations Update to version 4.14.8 or later. Restrict access to the filename parameter within the DistributedAPI to prevent unauthorized file deletion.