Path Traversal Vulnerability in Wazuh Affected by Malicious File Deletion

CVE-2026-74031

What is CVE-2026-74031?

Wazuh versions prior to 4.14.8 exhibit a path traversal vulnerability in the delete_rule_file and delete_decoder_file functions. This flaw allows malicious actors holding the cluster key to manipulate the filename parameter, potentially leading to the unauthorized deletion of critical system files such as ossec.conf and client.keys. By exploiting this weakness through DistributedAPI with crafted traversal sequences, attackers can compromise the integrity of the Wazuh environment and disrupt normal operations.

References