The vulnerability is a file traversal flaw in the get_lists() and delete_list_file CDB list handlers of Wazuh manager versions 4.1.1 to 4.14.7. Compromised cluster worker nodes can send specially crafted traversal or absolute‑path filenames over the internal cluster RPC interface. The attacker can read or delete critical master files such as rbac.db, potentially bypassing RBAC enforcement and exposing or destroying authorization data. The flaw has a CVSS score of 8.4, indicating a high‑severity risk of data loss and privilege escalation.

Affected vendors and products are Wazuh’s wazuh‑manager component. All releases from 4.1.1 through 4.14.7 are vulnerable; the issue is fixed in 4.14.8 and later. No additional vendor classes or products are listed.

The exploit requires the attacker to control or compromise a cluster worker node, or otherwise authenticate to the internal cluster RPC channel. Once operational, the attacker can request file operations that traverse outside the intended directory. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, but the high CVSS rating and the ability to delete core RBAC files make the risk significant for deployments that rely on the default cluster configuration for isolation.