A path‑traversal flaw in the cluster synchronization code lets a cluster peer write an arbitrary file inside the WAZUH_PATH of the manager. The flaw arises because the unmerge process combines peer‑controlled values from a merged‑file header with a file path without proper confinement, enabling an attacker who controls a peer and shares the Fernet key to target files such as /var/ossec/etc/ossec.conf. Overwriting this configuration file allows the attacker to inject executable commands that are run when Wazuh services are reloaded, resulting in code execution with root privileges. This vulnerability is classified as a file‑path traversal deficiency (CWE‑22).

The vulnerability impacts Wazuh installations that use the clustering feature from version 4.0.0 up to, but not including, the fixed release 4.14.6, and from the beta releases 5.0.0‑beta1 through 5.0.0‑beta2. Installations running any of these vulnerable versions with an enabled cluster and the shared Fernet key are at risk. If cluster mode is disabled, the issue is not exploitable.

The CVSS base score of 9.1 indicates a very high severity. Because the EPSS score is 0.00754 (less than 1 %), the exploitation probability is currently low but non‑zero, implying that while widespread attacks have not yet been reported, the vulnerability could be abused by an attacker with cluster access. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, indicating no known widespread exploitation has been observed. An attacker who gains participation in the cluster and shares the Fernet key can supply a malicious merged‑file header, allowing arbitrary file writes that lead to root‑level code execution on the manager host.