CVE-2026-48024

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Wazuh versions 5.0.0-beta1 through 5.0.0-beta2

Description An issue exists where the cluster.unmerge info() function in framework/wazuh/core/cluster/cluster.py constructs paths using peer-controlled merge type and name values within a merged synchronization archive. Additionally, the process files from worker() function in framework/wazuh/core/cluster/master.py fails to properly confine the resulting path to the designated cluster item directory. A cluster peer possessing the shared Fernet key—a symmetric encryption key used for secure data exchange—can employ path traversal via files metadata.json or a merged-file header to overwrite critical files, such as /var/ossec/etc/ossec.conf. Modifying this configuration file allows for the definition of root-executed commands, potentially leading to arbitrary code execution when Wazuh services are reloaded.

Recommendations Update to version 4.14.6. Update to version 5.0.0-beta3.