Directory Traversal Vulnerability in Wazuh by Wazuh
CVE-2026-48162
What is CVE-2026-48162?
A directory traversal vulnerability exists in Wazuh, an open-source platform for threat detection and response, affecting versions 4.0.0 to 4.14.6 and 5.0.0-beta3. The flaw arises from the DistributedAPI.send_tmp_file() function, which improperly handles an attacker-controlled temporary file value. This oversight allows a malicious cluster peer with access to the shared Fernet key to exploit path traversal or absolute path techniques to access sensitive files. Specifically, the vulnerability could lead to the exposure of /var/ossec/api/configuration/security/private_key.pem, enabling the unauthorized generation of administrator REST API tokens, thereby granting the attacker administrative privileges without the need for an account. Users are advised to update to versions 4.14.6 or 5.0.0-beta3 to mitigate this risk.
Affected Version(s)
wazuh >= 4.0.0, < 4.14.6 < 4.0.0, 4.14.6
wazuh >= 5.0.0-beta1, < 5.0.0-beta3 < 5.0.0-beta1, 5.0.0-beta3