The vulnerability is a path traversal flaw in the get_list_file helper within Wazuh 4.1.1 through 4.14.7. Malicious cluster workers can supply crafted filenames that bypass validation, enabling them to read files that are normally only accessible to the wazuh process. The impact is the potential leakage of sensitive configuration files such as client.keys and ossec.conf, which may contain cluster keys and other secrets. This constitutes a confidentiality disclosure and any compromised file may aid further attacks.

All Wazuh Manager installations from version 4.1.1 up to, but not including, 4.14.8 are vulnerable. The description states that the flaw exists in the get_list_file helper used by cluster workers. Only installations that employ the distributed cluster API and retain the cluster key are vulnerable. Since the CNA data does not explicitly provide an affected version range, this inference is derived from the vulnerability description.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid cluster key and the ability to send DistributedAPI requests with traversal filenames; the attack surface is limited to authenticated cluster workers. If successfully leveraged, an attacker can read arbitrary files readable by the wazuh process, which directly affects confidentiality. The moderate CVSS score and lack of a publicly known exploit reduce the likelihood of widespread immediate exploitation, but the risk remains significant for cluster environments that have not yet applied the patch.