Wazuh up to 4.14.6/5.0.0-beta2 ip-customblock ip-customblock.c remove srcip path traversal

Summaryinfo

A vulnerability has been found in Wazuh up to 4.14.6/5.0.0-beta2 and classified as very critical. The affected element is the function remove of the file ip-customblock.c of the component ip-customblock. The manipulation of the argument srcip leads to path traversal. This vulnerability is listed as CVE-2026-54083. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Wazuh up to 4.14.6/5.0.0-beta2. It has been rated as very critical. This issue affects the function remove of the file ip-customblock.c of the component ip-customblock. The manipulation of the argument srcip with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The  ip-customblock  active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script builds a file path by concatenating the  srcip  field taken from alert JSON directly onto the fixed  /ipblock/  base directory, without validating that the value is a well-formed IP address. Because the extraction routine returns the raw string unchecked, an attacker who can trigger alert-matching log events with a crafted  srcip  containing  ../  sequences can escape the base directory. The block action opens the resulting path in append mode, creating an empty file at an arbitrary location, while the unblock action passes it to remove(), deleting an arbitrary file; since the active response daemon runs as root, this includes sensitive files such as system credentials and Wazuh configuration. Unlike the sibling scripts host-deny.c, default-firewall-drop.c, and firewalld-drop.c, which reject non-IP input via get_ip_version(), ip-customblock.c omits this validation. This issue is fixed in version 4.14.7.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-54083 since 06/11/2026. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/28/2026). MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 4.14.7 or 5.0.0-beta3 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Wazuh

Version

• 4.14.0
• 4.14.1
• 4.14.2
• 4.14.3
• 4.14.4
• 4.14.5
• 4.14.6
• 5.0.0-beta1
• 5.0.0-beta2

Website

• Product: https://github.com/wazuh/wazuh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion