The vulnerability is a path traversal flaw in Wazuh manager that lets an authenticated cluster peer supply a specially crafted node name in the cluster hello message. When the master receives this payload and initiates cleanup of a disconnected peer, it deletes files and folders that match the supplied node name pattern. As a result, an attacker can delete any directory within the Wazuh installation path that is writable by the wazuh user, causing data loss or service disruption.

Affected product is Wazuh manager version 4.0.0 up to but not including 4.14.6. Users running Wazuh 4.0.0 through 4.14.5 are vulnerable. The vulnerability applies to all deployments where the manager communicates with cluster peers using a Fernet key.

The CVSS score is 7, indicating a high severity vulnerability. EPSS not available suggests limited intelligence on real-world exploitation, and it is not listed in CISA KEV. Attackers need to possess a valid cluster Fernet key, which typically belongs to administrators. With this credential, an attacker can send a crafted node name during the cluster hello handshake, and when the peer disconnects, the master deletes the targeted directories. The ability to delete arbitrary directories makes this a significant risk to data integrity and availability.