PT-2026-111563 · Git+1 · Wazuh+1
CVSS v3.1
6.1
Medium
| Vector | AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get lists() and delete list file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wazuh
Wazuh Manager