The vulnerability arises from a logic flaw in the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted). During agent enrollment, the manager accepts group names without filtering path traversal characters such as "..", allowing an attacker to specify a malicious group path. Because the manager later uses this unchecked value when constructing the path for configuration synchronization, the remoted process inadvertently serves files from the manager's configuration directory (/var/ossec/etc). Sensitive artifacts such as client.keys, ossec.conf, and internal certificates are exposed to the attacker through the agent's configuration stream. The weakness is identified as a path traversal flaw (CWE-22), which can lead to unauthorized disclosure of protected configuration data.

The affected product is Wazuh, an open‑source security monitoring platform. Versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4 are vulnerable. The issue is fixed in versions 4.10.4 and 4.14.5 onward.

With a CVSS score of 7.5, the flaw is considered moderately severe. The EPSS score is below 1 %, indicating a low probability of exploitation in the near future. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker controlling an agent or exploiting the enrollment process to create a group name containing "..", which then triggers the remoted process to read and transmit files located above the intended configuration directory. Because no authentication is required for enrollment, the path traversal can be performed by any entity capable of initiating agent enrollment, making the risk material for environments where agents are deployed extensively.