CVE-2026-93347

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93347

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93347.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-93347

Aliases

GHSA-xrjw-cqrv-j92g

Published

2026-10-13T13:27:34Z

Modified

2026-10-15T02:47:50Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file

Details

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93347.json"
}

References

Affected packages

Git / github.com/wazuh/wazuh

Affected ranges

Type

GIT

Repo

https://github.com/wazuh/wazuh

Events

Introduced

2b3defbedd063c4abbcdab3262b231d30af993be

Fixed

f470ad7db717b18db7feeed568949643698f0f34

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "4.1.1"
        },
        {
            "fixed":  "4.14.8"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93347.json"