Description

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T18:19:33.610Z",
  "pubdate": "2026-08-18T18:19:33.610Z",
  "executiveSummary": "A path traversal vulnerability exists in Wazuh versions 4.0.0 through 4.14.5, specifically residing in the agent enrollment mechanism. The vulnerability stems from insufficient input validation within the OS_IsValidName() function and unsafe path concatenation logic in the delete_diff() function. This flaw allows unauthenticated remote attackers interacting with the enrollment port to trigger a severe denial of service condition. By supplying a specially crafted agent name consisting of dot-sequences such as '..', an attacker can manipulate directory resolution paths to target the parent queue directory. Consequently, the affected system deletes critical subdirectories, halting all Wazuh services and requiring manual administrative intervention for system recovery. The risk implication is critical due to the unauthenticated nature of the attack vector, the exposure of the enrollment service over the network, and the complete disruption of security monitoring capabilities on the affected host without requiring prior privileges or sophisticated payload execution.",
  "technicalDetails": "The vulnerability is rooted in inadequate sanitization and validation of agent names processed during the remote agent enrollment phase. Specifically, the input validation routine OS_IsValidName() fails to adequately restrict directory traversal sequences like '..' when processing agent identifiers. When an unauthenticated remote attacker initiates an agent enrollment request via the enrollment port using a dot-sequence payload, the application improperly accepts the input.\nSubsequent execution flows into the delete_diff() function, which performs unsafe path concatenation utilizing the maliciously crafted agent name. Because the input lacks proper normalization and boundary enforcement, path resolution traverses upward from the intended working directory to the parent queue directory. As the deletion routine processes the resolved path, it recursively removes subdirectories located within the critical queue path.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker connects to the exposed Wazuh enrollment port over the network. 2) The attacker transmits an enrollment request containing a dot-sequence agent name (e.g., '..'). 3) The OS_IsValidName() function validates the input without blocking traversal characters. 4) The delete_diff() function unsafely concatenates the malicious string, causing the working directory context to resolve to the parent queue directory. 5) The application executes recursive deletion commands against the resolved path. 6) Critical subdirectories within the queue are purged, destroying necessary operational data structures.\nThe vulnerable components include the OS_IsValidName() function and the delete_diff() function within Wazuh versions 4.0.0 up to 4.14.5. Exploitation requires network access to the Wazuh enrollment port, but no authentication, user interaction, or prior privileges. The post-exploitation impact is exclusively destructive, resulting in an immediate denial of service characterized by the stoppage of all Wazuh services and necessitating manual recovery procedures by an administrator to restore system operations."
}