CVE-2026-74043

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.1.1 through 4.14.7

Description A path traversal issue exists in the upload list file, upload rule file, and upload decoder file functions. Attackers possessing the cluster key can send DistributedAPI requests containing ../ sequences in the filename variable, bypassing REST controller validation. This allows malicious cluster workers to write files to arbitrary paths as the wazuh user. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update to version 4.14.8 or later.