CVE-2026-93347

MEDIUM 4.9

Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file

CVSS Score

4.9

EPSS Score

0.0%

EPSS Percentile

0th

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files.

CWE	CWE-22
Vendor	wazuh
Product	wazuh-manager
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for wazuh wazuh-manager

Be the first to know when new medium vulnerabilities affecting wazuh wazuh-manager are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Wazuh / wazuh-manager

4.1.1 < 4.14.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/wazuh/wazuh/security/advisories/GHSA-xrjw-cqrv-j92g github.com: https://github.com/wazuh/wazuh/releases/tag/v4.14.8 vulncheck.com: https://www.vulncheck.com/advisories/wazuh-4.1.1-before-4.14.8-path-traversal-via-cluster-get-list-file

Credits

🔍 namd0ng vikman90