The vulnerability arises from a missing origin check in the wm_agent_upgrade component, which allows an enrolled agent to send an upgrade_custom command that includes an attacker‑controlled file_path. By injecting this message over the agent channel, the attacker can read arbitrary files as the system’s root user, potentially exfiltrating sensitive files such as /etc/shadow or client.keys. This flaw results in a high‑severity breach of confidentiality, giving the attacker privileged read access to the underlying operating system.

The flaw affects installations of Wazuh Manager from version 4.1.0 through 4.14.7. Systems running any of these builds are vulnerable if they allow agent-to‑manager communication for upgrade commands.

The CVSS score of 8.7 classifies the vulnerability as high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to have access to an enrolled agent; the attacker can then inject the upgrade_custom message over the agent channel. Given the escalation to root file read, the risk to confidentiality is significant.