InfoSecBulletin Cybersecurity for mankind
Wazuh has fixed a critical issue dubbed CVE-2026-30893 which is rated 9.0 on the CVSS scale allowing an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. This can be escalated to code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components.
The flaw is found in Wazuh’s system, especially in the decompress_files() function used for syncing the cluster. When Wazuh cluster nodes share data, they send archives with different setup and operational files.
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
The receiving node takes file paths directly from the incoming archive and passes them to os.path.join() without any normalization or containment checks. A compromised or malicious peer can craft an archive with traversal paths.
When the victim node does the sync, it saves the attacker’s content to the given path, even if it is not in the right sync folder.
Because Wazuh is often tasked with protecting high-value workloads, the impact of this vulnerability depends heavily on the deployment context:
Standard Installations: The daemon usually works as the wazuh user. In this case, an attacker can change Python modules in /var/ossec/wodles/. Since the system runs these modules often, the attacker gets to run code in the Wazuh service.
Docker & Elevated Deployments: In many container setups, the Wazuh program runs as root automatically. This raises the danger of a full system takeover. Attackers can change files in /etc/cron.d/ for scheduled tasks or add their own keys to /root/.ssh/authorized_keys for lasting, high-level access.
While the attack needs the person to be a “verified” cluster peer, this gives little reassurance in today’s distributed systems. If one node in a cluster is hacked through another method, this weakness lets the attacker quickly “spread” to every other node, changing a local problem into a worldwide failure.
The Wazuh team has put out a fix that adds strict rules for paths and makes them standard. All admins should upgrade their clusters right away.
