Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems, FIMDBCreator::encodeString() does not escape the value. A local user who can create a filename in a File Integrity Monitoring directory can inject a UNION SELECT expression when wazuh-syscheckd processes or deletes that path. The confirmed primitive manipulates SELECT result sets consumed by the FIM code; stacked statements and remote code execution were not demonstrated. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T17:18:53.770Z",
  "pubdate": "2026-08-19T17:18:53.770Z",
  "executiveSummary": "A vulnerability exists in the Wazuh threat prevention, detection, and response platform affecting versions from 4.6.0 until 4.14.6 and 5.0.0-beta3. The flaw is categorized as an SQL injection vulnerability arising from improper string handling during database query construction within the File Integrity Monitoring (FIM) subsystem.\nThe security issue impacts non-Windows systems where monitored file paths are directly concatenated into SQLite row filters without proper escaping via FIMDBCreator::encodeString(). An authenticated local user capable of creating a malicious filename within a monitored FIM directory can exploit this behavior.\nDuring the processing or deletion of the crafted path by wazuh-syscheckd, the attacker can successfully inject a UNION SELECT expression. The confirmed exploitation primitive allows manipulation of SELECT result sets consumed internally by the FIM codebase, although stacked queries and remote code execution were not demonstrated.\nThe risk implication involves unauthorized data manipulation of internal FIM database query results, potentially impacting system integrity monitoring reliability. Remediation requires upgrading to the patched software versions.",
  "technicalDetails": "The vulnerability resides in the src/syscheckd/src/db/src/file.cpp component of Wazuh, specifically within the DB::getFile() and DB::searchFile() functions. These functions are responsible for interacting with the SQLite database used by the File Integrity Monitoring (FIM) engine.\nThe root cause of the vulnerability is the unsafe concatenation of monitored file paths directly into SQLite row filters. On non-Windows operating systems, the FIMDBCreator::encodeString() function fails to properly escape the provided string value before it is integrated into the database query string.\nExploitation requires local access with the capability to create specific filenames within a directory that is actively monitored by Wazuh FIM. Network exposure is not required, as the vector relies on local filesystem interactions processed by the wazuh-syscheckd daemon.\nThe step-by-step attack flow proceeds as follows: First, a local user with file creation privileges crafts a filename containing malicious SQL syntax, specifically designed to leverage a UNION SELECT injection vector. Second, this file is placed within a directory monitored by Wazuh's File Integrity Monitoring component. Third, the wazuh-syscheckd process detects the file or processes a deletion event for the path. Fourth, the vulnerable functions DB::getFile() or DB::searchFile() take the raw file path and concatenate it directly into the SQLite filter query without proper sanitization by FIMDBCreator::encodeString(). Finally, the injected UNION SELECT expression is executed by the SQLite database engine.\nThe payload behavior is restricted to manipulating the SELECT result sets consumed by the FIM code, allowing the attacker to influence internal query results processed by wazuh-syscheckd. Remote code execution and stacked statements were not demonstrated in the scope of this vulnerability.\nAffected versions include Wazuh from 4.6.0 up to, but excluding, 4.14.6, as well as 5.0.0-beta3. The issue is resolved in versions 4.14.6 and 5.0.0-beta3."
}