CVE-2026-61800

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. During cluster file synchronization, the non-merged branch of update_master_files_in_worker() moves each staged file to a destination derived only from safe_join(), which confines the path to /var/ossec but never verifies that the file lands in the directory declared by its cluster_item_key. Because the destination check present on the primary node and on the worker's merged branch was not applied, a peer can place files at attacker-chosen locations under /var/ossec, including paths that are executed as root, and the delete branch has the same gap. This is an incomplete fix for CVE-2026-30893, which addressed traversal outside /var/ossec but left this path able to redirect files anywhere within it. This issue is fixed in version 4.14.7.

• CWE-22

• https://github.com/wazuh/wazuh/commit/f7f7c4d2d9e683c5d42e997fe7028a3fb2578853Patch
• https://github.com/wazuh/wazuh/security/advisories/GHSA-3jff-488g-335fExploit, Vendor Advisory

Published

Aug 28, 2026

Last Modified

Sep 15, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6178The Betheme theme for WordPress is vulnerable to Stored Cros…6.4
• CVE-2026-61783Wazuh is an open-source security platform providing unified …6.5
• CVE-2026-6179Stored Cross Site Scripting in NightWolf Penetration Testing…5.4
• CVE-2026-61790Weblate is a web-based continuous localization platform used…4.4
• CVE-2026-61792Weblate is a web-based continuous localization platform used…7.7
• CVE-2026-6180A race condition exists in PaperCut MF when processing badge…8.1
• CVE-2026-61802Wazuh is an open-source security platform providing unified …6.5
• CVE-2026-61807Snipe-IT is an IT asset/license management system. Prior to …6.3
• CVE-2026-61808LightRAG provides simple and fast retrieval-augmented genera…9.8
• CVE-2026-6181The Device Configuration Framework is vulnerable to an authe…5.9
• CVE-2026-6182A vulnerability was identified in code-projects Simple Conte…7.3
• CVE-2026-61824Defuddle cleans up HTML pages. Prior to 0.19.1, site extract…8.2