A path traversal flaw in Wazuh’s delete_rule_file and delete_decoder_file helpers lets an attacker supply an unvalidated filename, causing the service to delete arbitrary files. The flaw permits removal of critical configuration files such as ossec.conf, client.keys, and rules, which can disrupt service operation or enable further compromise. The weakness is a classic Path Traversal (CWE‑22).

Vulnerable versions of the Wazuh Manager, from 4.1.1 up to but not including 4.14.8, including all patch releases 4.1.1‑4.14.7. The issue affects the wazuh user running the service on any supported platform where the distributed API is enabled.

The CVSS score of 7.0 indicates a high severity, and while EPSS data is not available, the vulnerability is exploitable only by an actor who controls a cluster worker and possesses the cluster key. An adversary could therefore invoke DistributedAPI calls to trigger the delete helpers with path traversal sequences. Because the exploit requires cluster‑level credentials, the risk is lower than a remote code execution but still high enough to warrant swift remediation. The vulnerability is not listed in CISA’s KEV catalog, yet the potential for severe availability and integrity impact supports immediate action.