CVE-2026-46343 evidence review
wazuh
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end_receiving_file() in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUH_PATH. A syn_i_w_m_e request with an unknown task_id reaches the cleanup branch, where an attacker-controlled filename is passed to os.path.join without canonicalization or confinement. Absolute paths and traversal sequences can therefore target files such as ossec.conf, jwt_secret.json, TLS certificates, and ruleset fil...
This record remains available for product and version identification, but it is not presented as a complete remediation procedure. Confirm the affected range and the supported fix in a direct vendor advisory before changing production systems.
Identify the product and installed version
Record whether wazuh is present, where it is installed, and which interfaces are exposed.
- Record the product name, package or appliance identifier, and installed version.
- Identify internet-facing, administrative, API, and internal access paths.
- Preserve the pre-change configuration and relevant service logs.
Compare the affected range
Use the current record as an identification aid: >= >= 4.0.0, < 4.14.6, >= >= 5.0.0-beta1, < 5.0.0-beta2. Resolve incomplete inventory results before deciding that an asset is unaffected.
Verify the authoritative remediation source
Open the linked source material and locate a direct vendor advisory for this CVE. Confirm the supported fixed release and product-specific update path before making a production change.
Operational boundary
This page does not replace the vendor advisory, support contract, change-management process, or recovery plan. Do not infer that an asset is unaffected from an incomplete inventory query or a missing fixed-version field.