Local File Injection Vulnerability in Wazuh Threat Detection Platform
CVE-2026-49392
What is CVE-2026-49392?
A local file injection vulnerability exists in Wazuh's file integrity monitoring capabilities. The vulnerability arises from the improper processing of monitored file paths within SQLite row filters in versions 4.6.0 through 4.14.6 and 5.0.0-beta3. Specifically, the functions DB::getFile() and DB::searchFile() do not adequately escape input, allowing local users to craft malicious filenames. This can lead to the injection of UNION SELECT statements during processing or deletion of monitored paths, potentially manipulating the results consumed by the file integrity monitoring (FIM) functionality, although no remote code execution has been demonstrated. This issue has been addressed in the releases 4.14.6 and 5.0.0-beta3.
Affected Version(s)
wazuh >= 4.6.0, < 4.14.6 < 4.6.0, 4.14.6
wazuh >= 5.0.0-beta1, < 5.0.0-beta3 < 5.0.0-beta1, 5.0.0-beta3