CVE-2026-46343

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Wazuh versions 5.0.0-beta1 and earlier

Description A flaw in the WazuhCommon.end receiving file() function within framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside the WAZUH PATH. This occurs when a syn i w m e request containing an unknown task id triggers a cleanup branch where an attacker-controlled filename is passed to os.path.join without canonicalization or confinement. Consequently, absolute paths and traversal sequences can be used to target critical files accessible to the Wazuh manager process, such as ossec.conf, jwt secret.json, TLS certificates, and ruleset files. The deletion of these files can disable the manager, invalidate API tokens, or disrupt cluster and API connectivity.

Recommendations Update to version 4.14.6. Update to version 5.0.0-beta2.