CVE-2026-54083 wazuh CVE debrief

Who should care

Defenders and administrators using the Wazuh security platform should assess exposure and prioritize updating to version 4.14.7 or later. Security teams responsible for vulnerability management, platform operators, and those monitoring Wazuh deployments need to be aware of this vulnerability's impact. Affected operators must review compensating controls and plan for updates or mitigations to prevent potential file system manipulation.

Why it matters

The path traversal vulnerability in the ip-customblock active response script of Wazuh allows an attacker to create or delete arbitrary files on the filesystem as root. Defenders and administrators using Wazuh should assess exposure and prioritize updating to version 4.14.7 or later.

• Potential for arbitrary file creation or deletion as root
• Possible disruption of Wazuh platform operations
• Potential exposure of sensitive files such as system credentials

Technical summary

The ip-customblock active response script in Wazuh contains a path traversal vulnerability. The script builds a file path by concatenating the srcip field from alert JSON directly onto a fixed base directory without validation. This allows an attacker to create or delete arbitrary files on the filesystem as root. The vulnerability arises from the script's failure to validate the srcip field, unlike sibling scripts that use get_ip_version() for IP validation. The issue is fixed in version 4.14.7, which addresses the path traversal vulnerability.

Defensive priority

High

Recommended defensive actions

• Review and update Wazuh to version 4.14.7 or later
• Restrict access to the ip-customblock active response script
• Monitor for suspicious activity on the Wazuh platform
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The ip-customblock active response script in Wazuh contains a path traversal vulnerability. The issue is fixed in version 4.14.7. Evidence from the CVE Program and NVD detail page confirms the vulnerability's existence and impact. Defenders should verify affected Wazuh deployments and plan for updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.