Path Traversal Vulnerability in Wazuh's ip-customblock Script

CVE-2026-54083

What is CVE-2026-54083?

A path traversal vulnerability exists in Wazuh's ip-customblock active response script, allowing attackers to manipulate the file system by creating or deleting arbitrary files with root privileges. The vulnerability arises because the script improperly processes the source IP address from alert JSON input, leading to insufficient validation. This flaw permits an attacker to insert '../' sequences into the srcip field, bypassing the security measures that are typically in place for other response scripts. As a result, files can be created or deleted at arbitrary locations within the filesystem, potentially compromising sensitive system files including credentials and configuration settings. This issue was addressed in Wazuh version 4.14.7.

References