CVE-2026-93347

CVSS 6.9 (medium) · published 2026-10-13

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files.

Weakness: CWE-22

Source: NVD CVE-2026-93347

References

• https://github.com/wazuh/wazuh/releases/tag/v4.14.8
• https://github.com/wazuh/wazuh/security/advisories/GHSA-xrjw-cqrv-j92g
• https://www.vulncheck.com/advisories/wazuh-4.1.1-before-4.14.8-path-traversal-via-cluster-get-list-file
• https://github.com/wazuh/wazuh/security/advisories/GHSA-xrjw-cqrv-j92g

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.