Wazuh CVE-2026-49392

The attacker must be authenticated to the host OS as a local user with filesystem write permissions to at least one directory actively listed in Wazuh's FIM monitoring configuration (e.g., via <directories> in ossec.conf). The system must run Linux or macOS - Windows is explicitly excluded because the Windows code path applies escaping that the non-Windows FIMDBCreator::encodeString() omits. The wazuh-syscheckd daemon must be running and configured to monitor a directory to which the attacker has write access. Exploitation is bounded to SELECT result set manipulation within the local FIM SQLite database; the vendor confirmed that stacked statement execution and remote code execution were not achievable with this primitive. Limiting factors: no network access path exists, root or administrative OS privilege is not required but write access to a monitored path is, and the injection only triggers when the daemon actively scans or processes deletion events for the crafted filename.

The CVSS 3.1 score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) accurately captures the attack surface: local access with low privileges gates exploitation, preventing network-based or unauthenticated abuse. No EPSS score is available in the provided intelligence, but the local-only vector and vendor confirmation that stacked statements and remote code execution were not demonstrated constrain impact to SELECT result set manipulation - data falsification within the FIM database rather than system-level compromise. No CISA KEV listing exists and no independently published exploit has been confirmed; the 'RCE' tag present in the intelligence feed is directly contradicted by the vendor advisory and the PR diff, which explicitly state RCE was not demonstrated - that tag should be disregarded and not drive escalated response. Even a mid-sized municipal IT team in gniezno should treat this as a medium-priority patch, however, because the affected component is Wazuh's integrity monitoring engine itself: successfully injecting fabricated FIM results could suppress detection of file tampering, creating a blind spot in the very tool used to catch intrusions. The security-function impact is disproportionately significant relative to the raw CVSS score.

A local user with write access to a directory monitored by Wazuh FIM - such as /tmp or an application log directory - creates a file named with an embedded SQL payload (e.g., evil"UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17--). When wazuh-syscheckd next scans or processes a delete event for that path, the unsanitized filename is interpolated directly into the SQLite row filter, causing the injected UNION SELECT to execute and return attacker-controlled rows alongside legitimate FIM records. The PR test suite in the fix commit confirms this primitive produces no error and returns FIMDB_OK, meaning the injection is silent and the falsified data propagates into FIM alert logic.