CVE-2026-74038

Katalog CVE

CVSS 7.1 · High EPSS 0,55%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada wazuh. Skor CVSS 3.1 7.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.

Rincian

Terbit di NVD

18 Agustus 2026

Terakhir diubah

1 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wazuh/wazuh/security/advisories/GHSA-573w-mqw4-jvmr exploit · mitigasi · advisory vendor
• https://github.com/wazuh/wazuh/pull/35833 issue tracking · patch
• https://www.vulncheck.com/advisories/wazuh-path-traversal-dos-via-agent-enrollment advisory pihak ketiga