CVE-2026-49392

Wazuh, an open-source threat detection and response platform, fails to sanitize monitored file paths before concatenating them into SQLite queries in DB::getFile() and DB::searchFile() (src/syscheckd/src/db/src/file.cpp); on non-Windows systems FIMDBCreator::encodeString() does not escape the value. A local user who can create a file in a directory monitored by File Integrity Monitoring can name it with a crafted SQL fragment, which is injected as a UNION SELECT when wazuh-syscheckd processes or deletes that path. The demonstrated impact is manipulation of SELECT result sets consumed by the FIM engine (limited confidentiality, integrity, and availability effects, CVSS 5.3); stacked queries and remote code execution were not shown. Affected deployments are Wazuh 4.6.0 up to (but excluding) 4.14.6 and 5.0.0 beta releases prior to 5.0.0-beta3 on Linux/Unix agents. The issue is fixed in 4.14.6 and 5.0.0-beta3, and there is no evidence of in-the-wild exploitation (EPSS 0.3%, not in CISA KEV).

What to do: Upgrade Wazuh agents and managers to 4.14.6 or later (or 5.0.0-beta3 or later) as the primary remediation. In the interim, restrict write access to FIM-monitored directories on non-Winux hosts to trusted users and service accounts, since exploitation requires a local user able to create files there. Review syscheckd database queries and FIM alerts for anomalous result manipulation on hosts running affected versions, and treat this as routine-priority patching given the local, low-impact nature of the confirmed primitive.