A path‑traversal flaw in the decompress_files() routine of Wazuh’s cluster synchronization routine allows an authenticated peer to write files outside the intended extraction directory. By overwriting Python modules that Wazuh loads, a malicious cluster node can inject code that runs in the Wazuh service context. If the cluster daemon runs with elevated privileges, this escalation can lead to system‑level compromise. The vulnerability directly threatens confidentiality, integrity, and availability of the affected nodes and can be used to execute arbitrary code on any node that trusts the peer.

Wazuh installations between version 4.4.0 (inclusive) and version 4.14.4 (exclusive) are affected. The issue is present in all products distributed under the wazuh:wazuh CNA identification. Affected components include the cluster daemon responsible for synchronizing rules, decoders, and other configuration artifacts across nodes.

The CVSS score of 9 indicates a critical severity. The EPSS score is not available, so the exploitation probability is unknown; however, because the flaw requires authenticated cluster peers, an attacker must gain legitimate cluster credentials or compromise an existing node. The vulnerability is not listed in CISA’s KEV catalog. If the cluster daemon operates with elevated privileges, the potential impact scales from arbitrary file write to full system compromise. Exploitation would involve crafting a malicious archive to trigger the decompression routine on a target node, leveraging the path traversal to overwrite critical Python modules and achieve code execution.