CVE-2026-30893— Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-30893
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer
Source: NVD (National Vulnerability Database)
Vulnerability Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. This can be escalated to code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components (proof of concept available as separate attachment). In deployments where the cluster daemon runs with elevated privileges, system-level compromise is possible. This issue has been patched in version 4.14.4.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Wazuh 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Wazuh是Wazuh开源的一个应用软件。用于收集，汇总，索引和分析安全数据，帮助组织检测入侵，威胁和行为异常。 Wazuh 4.4.0版本至4.14.4之前版本存在路径遍历漏洞，该漏洞源于集群同步提取中的路径遍历，可能导致任意文件写入和代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2026-30893
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-30893
请登录查看更多情报信息。
- Release Wazuh v4.14.4 · wazuh/wazuh · GitHubx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-30893
Same Patch Batch · wazuh · 2026-04-29 · 5 CVEs total
| CVE-2026-26206 | 6.5 MEDIUM | Wazuh: API brute-force protection bypass via race condition in login attempt tracking |
| CVE-2026-41499 | 6.5 MEDIUM | Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string() |
| CVE-2026-28221 | 6.5 MEDIUM | Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print_hex_string() due to sig |
| CVE-2026-26204 | 4.4 MEDIUM | Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertData |
IV. Related Vulnerabilities
Same product: wazuh
- CVE-2026-41499
Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in p - CVE-2026-28221
Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted - CVE-2026-26206
Wazuh: API brute-force protection bypass via race condition - CVE-2026-26204
Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertDat - CVE-2023-7340
Wazuh authd service (os_auth) Heap-based Buffer Overflow
Same vendor: wazuh
- CVE-2026-41499
Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in p - CVE-2026-28221
Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted - CVE-2026-26206
Wazuh: API brute-force protection bypass via race condition - CVE-2026-26204
Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertDat - CVE-2025-15612
Wazuh Provisioning Scripts / Build Infrastructure Improper C
Same weakness: CWE-22
- CVE-2026-8274
npitre cramfs-tools Directory cramfsck.c do_directory path t - CVE-2022-50956
WordPress Plugin amministrazione-aperta 3.7.3 Local File Rea - CVE-2026-8215
Industrial Application Software IAS Canias ERP RMI iasReques - CVE-2026-42605
AzuraCast: Path Traversal in `currentDirectory` Parameter En - CVE-2026-42574
apko dirFS has a symlink-following path traversal that allow
V. Comments for CVE-2026-30893
No comments yet