CVE-2026-54083

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.14.7

Description The ip-customblock active response script contains a path traversal flaw allowing an attacker to create or delete arbitrary files on the filesystem with root privileges. The issue occurs because the script concatenates the srcip field from alert JSON directly to the /ipblock/ base directory without validating if the value is a well-formed IP address. An attacker can trigger alert-matching log events using a crafted srcip containing ../ sequences to escape the base directory. The block action creates an empty file at an arbitrary location by opening the path in append mode, while the unblock action deletes an arbitrary file via the remove() function. This can impact sensitive files, including system credentials and configuration files, because the active response daemon runs as root.

Recommendations Update to version 4.14.7. As a temporary mitigation, restrict the use of the ip-customblock active response script.