THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-48162 (CRITICAL 9.1) — Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmp_file value to WAZUH_PATH without can

[NVD] CVE-2026-48162 (CRITICAL 9.1) — Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmp_file value to WAZUH_PATH without can

mednvdPublished 2026-08-19

CVE-2026-48162 CVSS: 9.1 CRITICAL Published: 2026-08-19T17:18:51.233

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmp_file value to WAZUH_PATH without canonicalization or confinement. A cluster peer holdi

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-48162