The vulnerability is a path traversal flaw in Wazuh 4.x that permits an unauthenticated remote attacker to enroll an agent with a dot‑sequence name such as ".." via the enrollment port. The flaw arises from insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff(), which allows the attacker to resolve to the parent queue directory and delete its subdirectories. The resulting removal of the queue directory causes all Wazuh services that rely on it to stop, leading to a denial of service.

Affected systems include the Wazuh Manager component released before version 4.14.6, starting from the initial 4.0.0 release. The vulnerability is present in every Wazuh package that contains the vulnerable enrollment logic described above.

The vulnerability has a CVSS score of 7, which reflects a moderate to high severity. EPSS information is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers can exploit the flaw remotely without authentication by sending a carefully crafted enrollment request to the open enrollment port, causing the system to experience a denial of service. Given the lack of public exploitation data, the risk remains theoretical but the impact of a successful attack is severe due to the service disruption and manual recovery requirement.