Medium severity · published Oct 13, 2026
CVE-2026-93347
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
wazuh-manager · Wazuh
4.1.1 before 4.14.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93347
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93347
vendor-advisory
https://github.com/wazuh/wazuh/security/advisories/GHSA-xrjw-cqrv-j92g
patch
https://github.com/wazuh/wazuh/releases/tag/v4.14.8
third-party-advisory
https://www.vulncheck.com/advisories/wazuh-4.1.1-before-4.14.8-path-traversal-via-cluster-get-list-file
More from wazuh-manager
9.1
CVE-2026-74040
Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
9.0
CVE-2026-74043
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
7.5
CVE-2026-74034
Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
7.5
CVE-2025-15615
Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service
7.5
CVE-2026-32983
SSL/TLS Renegotiation DoS in Wazuh Manager authd service