The vulnerability resides in the ip-customblock active response script of the Wazuh security platform. Using a crafted IP address in an alert’s srcip field, an attacker can exploit a path traversal flaw that allows arbitrary file creation or deletion when the script runs. Because the active response daemon operates with root privileges, the attacker potentially writes or deletes system‑critical files or configuration data, leading to a full compromise of the affected host.

The flaw impacts the Wazuh open‑source platform, specifically any deployment that uses the ip-customblock active response script. All releases prior to 4.14.7 contain the vulnerable code and are susceptible.

The CVSS score of 8.1 indicates a high severity vulnerability. The EPSS score is not available, but the absence of a KEV listing does not diminish the risk; the flaw remains exploitable in any environment where an attacker can trigger alert generation with a malicious srcip value. Successful exploitation requires the attacker to generate an alert that includes a crafted IP address; the subsequent execution of the active response opens the resulting path in append mode to create a file or calls remove() to delete one. With the daemon running as root, this attack can lead to complete system compromise.