CVE-2026-74043— Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
Quick assessment
Affected
Wazuh wazuh-manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Wazuh 在 4.1.1 至 4.14.8 版本之间存在路径穿越漏洞，影响 upload_list_file、upload_rule_file 和 upload_decoder_file 功能。该漏洞允许恶意的集群节点在任意路径下写入文件。攻击者只要持有集群密钥，就可以构造包含 序列的文件名，通过向 DistributedAPI 发送请求，从而绕过 REST 控制器的验证，以 wazuh 用户的身份在任意路径写入文件。
Possible ATT&CK Techniques 1 AI
T1195 · Supply Chain CompromiseAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Wazuh | wazuh-manager | 4.1.1< 4.14.8 |
affected |
4.14.8 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74043
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
Source: CVE Program / CVE List V5
Vulnerability Description
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Wazuh | wazuh-manager | 4.1.1 ~ 4.14.8 | - |
|
II. Public POCs for CVE-2026-74043
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74043
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-74043 (2)
Vendor Pages for CVE-2026-74043 (1)
Same Patch Batch · Wazuh · 2026-10-13 · 15 CVEs total
| CVE-2026-74041 | 9.1 CRITICAL | Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch |
| CVE-2026-74040 | 9.1 CRITICAL | Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker |
| CVE-2026-74034 | 7.5 HIGH | Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command |
| CVE-2026-74036 | 7.2 HIGH | Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies |
| CVE-2026-74037 | 7.2 HIGH | Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token |
| CVE-2026-74035 | 7.2 HIGH | Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user |
| CVE-2026-74045 | 7.1 HIGH | Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder |
| CVE-2026-74047 | 6.5 MEDIUM | Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint |
| CVE-2026-74031 | 6.5 MEDIUM | Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers |
| CVE-2026-74033 | 6.1 MEDIUM | Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers |
| CVE-2026-93346 | 5.3 MEDIUM | Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition |
| CVE-2026-74030 | 4.9 MEDIUM | Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion |
| CVE-2026-93347 | 4.9 MEDIUM | Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file |
| CVE-2026-74032 | 4.3 MEDIUM | Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions |
IV. Related Vulnerabilities
Same product: wazuh-manager
-
CVE-2026-93347
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_lis -
CVE-2026-93346
Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass -
CVE-2026-74047
Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 00 -
CVE-2026-74045
Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-ana -
CVE-2026-74041
Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass
Same vendor: Wazuh
-
CVE-2026-93347
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_lis -
CVE-2026-93346
Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass -
CVE-2026-74047
Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 00 -
CVE-2026-74045
Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-ana -
CVE-2026-74041
Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass
Same weakness: CWE-22
-
CVE-2026-103820
CAI Content Credentials | Improper Limitation of a Pathname -
CVE-2026-90530
ColdFusion | Improper Limitation of a Pathname to a Restrict -
CVE-2026-79715
IBM WebSphere Application Server Liberty Path Traversal -
CVE-2026-63162
Omnispace Agora Project < 26.10.0 Path Traversal via tmpFold -
CVE-2026-106634
Adobe Experience Manager | Improper Limitation of a Pathname
V. Comments for CVE-2026-74043
No comments yet