Wazuh versions 4.1.1 through 4.14.7 contain a path traversal flaw in the upload_list_file, upload_rule_file, and upload_decoder_file functions. Attackers that possess the cluster key can send DistributedAPI requests with ‘../’ sequences in the filename field, bypassing REST controller validation and causing the manager to write files to arbitrary paths as the wazuh user. This allows modification of configuration files, placement of malicious scripts, or other file‑based attacks that can lead to remote code execution or elevated privileges on the host.

The vulnerability affects the Wazuh wazuh-manager product, specifically all releases starting with 4.1.1 up to and excluding 4.14.8. Users running any of these versions are at risk until patched.

The CVSS score of 8.5 indicates high severity, reflecting the potential for remote code execution if an attacker writes executable or harmful configuration files. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploit requires possession of a valid cluster key; therefore, an attacker must either compromise cluster authentication or impersonate a legitimate cluster worker. Once authenticated, the attacker can craft a request containing path‑traversal sequences and force the manager to create or overwrite files in arbitrary locations, granting further control over the affected system.