CVE-2026-30893

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. This can be escalated to code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components (proof of concept available as separate attachment). In deployments where the cluster daemon runs with elevated privileges, system-level compromise is possible. This issue has been patched in version 4.14.4.

• CWE-22
• CWE-73

• https://github.com/wazuh/wazuh/releases/tag/v4.14.4Release Notes
• https://github.com/wazuh/wazuh/security/advisories/GHSA-m8rw-v4f6-8787Vendor Advisory
• https://github.com/wazuh/wazuh/security/advisories/GHSA-m8rw-v4f6-8787Vendor Advisory

Published

Apr 29, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30887OneUptime is a solution for monitoring and managing online s…9.9
• CVE-2026-30888Discourse is an open-source discussion platform. Versions pr…5.5
• CVE-2026-30889Discourse is an open-source discussion platform. Prior to ve…4.9
• CVE-2026-3089Actual Sync Server allows authenticated users to upload file…6.5
• CVE-2026-30891Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2026-30892crun is an open source OCI Container Runtime fully written i…7.8
• CVE-2026-30894Lack of output escaping leads to a XSS vector in the content…6.1
• CVE-2026-30895Lack of output escaping leads to a XSS vector in the readmor…6.1
• CVE-2026-30896The installer for Qsee Client versions 1.0.1 and prior insec…8.4
• CVE-2026-30897A stack-based buffer overflow vulnerability in Fortinet Fort…6.6
• CVE-2026-30898An example of BashOperator in Airflow documentation suggeste…8.8
• CVE-2026-3090The Post SMTP – Complete Email Deliverability and SMTP Solut…7.2