Wazuh’s File Integrity Monitoring component, through the DB::getFile() and DB::searchFile() functions, concatenates monitored file paths into SQLite queries without proper escaping on non-Windows systems. A local user who can create a file in a monitored directory can inject a UNION SELECT payload that is later executed by wazuh-syscheckd. The confirmed primitive allows manipulation of SELECT result sets used by the FIM code but does not lead to stacked statements or remote code execution. The potential impact is the ability to read arbitrary data stored in the Wazuh SQLite database, compromising confidentiality of system configuration and audit data.

The vulnerability affects all Wazuh installations that use the default FIM configuration with versions 4.6.0 up to and including 4.14.6, as well as the 5.0.0-beta3 release. Customers running any of these versions on Linux or other non-Windows operating systems are impacted.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score of 0.00191, which is less than 1%, indicates an extremely low probability of exploitation, but the vulnerability still requires local access and the ability to create files in a monitored directory. Because it does not enable remote code execution or system-wide privilege escalation, the risk is limited to information disclosure. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been reported to date.