CVE details
CVE-2026-74038
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.
- Score
- 7.0 high
- Published
- 2026-08-18
- Links
- NVD · cve.org · Report wrong data
Matched ports (2)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| security/wazuh-agent | wazuh-agent | 4.14.9 | fixed by update | acm@FreeBSD.org |
| security/wazuh-manager | wazuh-manager | 4.14.9 | fixed by update | acm@FreeBSD.org |