PT-2026-35967 · Wazuh · Wazuh

Alimezar · Published 2026-03-17 · Updated 2026-05-22 · CVE-2026-30893

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.4.0 through 4.14.3

Description A path traversal issue exists in the cluster synchronization extraction routine, specifically within the decompress files() function. This allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. This flaw can be escalated to remote code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components. In environments where the cluster daemon operates with elevated privileges, a full system-level compromise is possible. Over 3,500 unpatched instances were identified as of 2026-05-10.

Recommendations Update to version 4.14.4.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

BDU:2026-06165

CVE-2026-30893

Affected Products

Wazuh

References · 15

• 🔥 https://github.com/wazuh/wazuh/security/advisories/GHSA-m8rw-v4f6-8787 · Exploit
• https://bdu.fstec.ru/vul/2026-06165 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-30893 · Security Note
• https://github.com/wazuh/wazuh/releases/tag/v4.14.4 · Note
• https://twitter.com/CCBalert/status/2054246827734544751 · Twitter Post
• https://twitter.com/cybrsecpath/status/2055258059589775768 · Twitter Post
• https://twitter.com/autumn_good_35/status/2054247354916860294 · Twitter Post
• https://twitter.com/CVEnew/status/2049578379247333449 · Twitter Post
• https://twitter.com/unknownmatter19/status/2054264252844978682 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2049822574356688900 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2057628843871993938 · Twitter Post
• https://t.me/CSIRT_italia/3482 · Telegram Post
• https://twitter.com/Shadowserver/status/2053900780684362027 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049598463612956937 · Twitter Post
• https://twitter.com/integ_sec/status/2052059304551665823 · Twitter Post