Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled file_path key from files_metadata.json. The destination is joined to WAZUH_PATH without proving that it remains inside the directory selected by cluster_item_key. A cluster peer holding the shared Fernet key can upload a crafted extra-valid archive and overwrite security-sensitive files such as /var/ossec/etc/ossec.conf. Replacing ossec.conf can configure root-executed commands and lead to code execution after a service reload. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-19T17:18:54.073Z",
  "pubdate": "2026-08-19T17:18:54.073Z",
  "executiveSummary": "A path traversal vulnerability exists in the Wazuh platform within the process_files_from_worker() function located in framework/wazuh/core/cluster/master.py. The flaw allows a cluster peer possessing the shared Fernet key to supply a maliciously crafted files_metadata.json containing a peer-controlled file_path key. Because the destination path is joined to WAZUH_PATH without adequate sanitization or boundary validation to ensure it remains restricted to the directory selected by cluster_item_key, an authenticated cluster node can overwrite arbitrary security-sensitive system files, such as /var/ossec/etc/ossec.conf.\nThe successful exploitation of this vulnerability leads to remote code execution with root privileges upon a subsequent service reload, as replacing ossec.conf permits the configuration of arbitrary root-executed commands. Affected systems include Wazuh versions from 4.3.0 until 4.14.6 and 5.0.0-beta3. The attack requires compromise or control of a cluster peer holding the valid shared Fernet key, allowing the attacker to upload an extra-valid archive that bypasses standard cluster communication validation while achieving full host system compromise.",
  "technicalDetails": "The vulnerability resides in the non-merged branch of the process_files_from_worker() function within framework/wazuh/core/cluster/master.py in Wazuh. The core root cause is an insufficient path validation flaw, specifically a lack of canonicalization checks or directory traversal protections when handling file paths received from cluster worker nodes during synchronization or file transfer operations.\nSpecifically, the vulnerable code extracts and trusts the file_path key provided within the peer-controlled files_metadata.json structure. This path is subsequently concatenated using path-joining operations directly onto the base WAZUH_PATH directory without verifying whether the resulting absolute path stays confined within the intended sandbox boundary defined by the cluster_item_key.\nTo execute an attack, an adversary must possess the shared Fernet key used for encrypting and authenticating cluster communications. This allows the attacker to authenticate successfully as a valid cluster peer and construct a heavily crafted, extra-valid archive payload. Within this archive, the files_metadata.json is manipulated to include directory traversal sequences (such as relative path components) inside the file_path parameter.\nWhen the master node processes this payload via process_files_from_worker(), the lack of bounds checking causes the file extraction routine to write arbitrary files outside of the designated cluster directory and into critical system locations. An attacker targets security-sensitive configuration files, most notably /var/ossec/etc/ossec.conf.\nFollowing the successful overwriting of ossec.conf, the attacker can inject malicious directives designed to execute arbitrary system commands under the context of the root user. Upon the next service reload or restart of the Wazuh daemon, the altered configuration is parsed and executed, leading to total system compromise and arbitrary remote code execution on the master node.\nAffected versions of Wazuh span from 4.3.0 up to, but excluding, 4.14.6, as well as version 5.0.0-beta3. The attack requires network exposure of the Wazuh cluster communication ports and possession of the shared Fernet key, but does not require local shell access on the master node prior to exploitation."
}