What is the CVSS score of EUVD-2026-26271?

EUVD-2026-26271 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-26271?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26271. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for EUVD-2026-26271?

Yes, a patch is available for EUVD-2026-26271. Update the affected software to the latest version immediately.

Wazuh Manager EUVD-2026-26271

| CVE-2026-30893 CRITICAL

Path Traversal (CWE-22)

2026-04-29 GitHub_M

RCE Python Path Traversal Wazuh

9.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 30, 2026 - 20:30 nvd

Patch available

Analysis Generated

Apr 29, 2026 - 20:08 vuln.today

Re-analysis Queued

Apr 29, 2026 - 19:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 29, 2026 - 18:30 euvd

EUVD-2026-26271

Analysis Generated

Apr 29, 2026 - 18:30 vuln.today

CVE Published

Apr 29, 2026 - 17:55 nvd

CRITICAL 9.0

DescriptionGitHub Advisory

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. This can be escalated to code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components (proof of concept available as separate attachment). In deployments where the cluster daemon runs with elevated privileges, system-level compromise is possible. This issue has been patched in version 4.14.4.

AnalysisAI

Wazuh Manager (4.4.0 through 4.14.3) contains a path traversal vulnerability in the cluster synchronization routine that allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. Writing to sensitive locations such as cron directories or Python module paths leads to remote code execution. CVSS 9.0 Critical (network-accessible, high privilege required, scope changed). Patch available in v4.14.4; no active exploitation identified.

Technical ContextAI

The vulnerability resides in decompress_files() within framework/wazuh/core/cluster/cluster.py. This function processes archive files received from cluster peers during normal synchronization. Output paths are constructed without any sanitization, allowing both relative traversal sequences (e.g. ../../../../etc/cron.d/backdoor) and absolute path injection (e.g. /etc/cron.d/backdoor) embedded inside attacker-crafted archive filenames. The flaw exists in three distinct call sites where decompress_files() is invoked.

Verified from source - single-line change between v4.14.3 and v4.14.4:

python

# VULNERABLE (v4.14.3)
full_path = os.path.join(decompress_dir, filepath.decode())
# PATCHED (v4.14.4)
full_path = safe_join(decompress_dir, filepath.decode())

safe_join() validates that the resolved path stays within the intended extraction directory, rejecting any filename that would escape it. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

RemediationAI

Upgrade to Wazuh Manager v4.14.4 or later. The fix replaces os.path.join() with safe_join() across all three call sites of decompress_files() in cluster.py, ensuring the resolved path cannot escape the designated extraction directory.

python

# Before (vulnerable)
full_path = os.path.join(decompress_dir, filepath.decode())
# After (patched)
full_path = safe_join(decompress_dir, filepath.decode())

References: GitHub release v4.14.4 - GHSA-m8rw-v4f6-8787

If immediate upgrade is not possible, restrict cluster network access to trusted peers only and audit recent sync activity for unexpected file writes outside /var/ossec/.