CVE-2026-74038 | BDVDB-2026-361995 Detail

Description#

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-18Record published in the CVE List.
2. Version 22026-10-01Most recent update recorded in the CVE List.