CVE-2026-46343

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-46343
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46343.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-46343
Aliases
  • GHSA-cqvw-w2rg-327f
Published
2026-08-19T16:07:58Z
Modified
2026-09-20T11:46:02Z
Severity
  • 7.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N CVSS Calculator
Summary
Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()
Details

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end_receiving_file() in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUH_PATH. A syn_i_w_m_e request with an unknown task_id reaches the cleanup branch, where an attacker-controlled filename is passed to os.path.join without canonicalization or confinement. Absolute paths and traversal sequences can therefore target files such as ossec.conf, jwt_secret.json, TLS certificates, and ruleset files that are accessible to the Wazuh manager process. Deletion can disable the manager, invalidate API tokens, or disrupt cluster and API connectivity. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46343.json"
}
References

Affected packages

Git / github.com/wazuh/wazuh

Affected ranges

Type
GIT
Repo
https://github.com/wazuh/wazuh
Events
Introduced
8c2c62a6e9dcbcf2c792f7924e8cfdb26842820b
Fixed
44c2925b46bd058d2426bd44ed1b3e5d7b7b03b4
Introduced
cddd833300cb5af494ba7dab31192bae649eb184
Fixed
90d43547d166cdbe65e9a3d011f946214df9179c
Fixed
b58b3b2552497639b1b2a2b23e8de87e4ce9cf02
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.14.6"
        },
        {
            "introduced": "5.0.0-beta1"
        },
        {
            "last_affected": "5.0.0-beta1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.0.0-beta1
v5.*
v5.0.0-beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46343.json"