EUVD-2026-62577Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Local write access to a FIM-monitored directory is required (AV:L, PR:L); impact confined to FIM SQLite SELECT manipulation with no scope change or full system compromise.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems, FIMDBCreator::encodeString() does not escape the value. A local user who can create a filename in a File Integrity Monitoring directory can inject a UNION SELECT expression when wazuh-syscheckd processes or deletes that path. The confirmed primitive manipulates SELECT result sets consumed by the FIM code; stacked statements and remote code execution were not demonstrated. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.
AnalysisAI
SQL injection in Wazuh's File Integrity Monitoring subsystem allows a local low-privileged user on non-Windows systems to manipulate the FIM SQLite database by creating a specially crafted filename in any monitored directory. The wazuh-syscheckd daemon in versions 4.6.0 through 4.14.5 concatenates unsanitized file paths directly into SQLite row filter predicates in DB::getFile() and DB::searchFile(), enabling UNION SELECT injection when the path is processed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be authenticated to the host OS as a local user with filesystem write permissions to at least one directory actively listed in Wazuh's FIM monitoring configuration (e.g., via `<directories>` in `ossec.conf`). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) accurately captures the attack surface: local access with low privileges gates exploitation, preventing network-based or unauthenticated abuse. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Wazuh 4.14.6 or 5.0.0-beta3, both of which resolve the injection by replacing string-concatenated SQL predicates with parameterized bind statements throughout the `dbsync` query layer. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node,
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
Arbitrary file deletion on a Wazuh manager via the cluster synchronization protocol allows a cluster-authenticated attac
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today