CVE-2026-54083

CVE-2026-54083 is a path traversal vulnerability (CWE-22, CVSS 3.1: 8.1 High) in the ip-customblock active response script of the open-source Wazuh XDR/SIEM platform. The script builds a file path by concatenating the srcip value taken from alert JSON directly onto the fixed /ipblock/ base directory without checking that it is a well-formed IP address, so an attacker who can cause log events that trigger matching alerts—supplying a crafted srcip containing ../ sequences—can escape the base directory. Because the active response daemon runs as root, the attacker gains the ability to create an arbitrary empty file (block action, via an append-mode open) or delete an arbitrary file (unblock action, via remove()), including sensitive files such as system credentials and Wazuh configuration; the CVSS vector reflects high integrity and availability impact with network access and low privileges required. Any Wazuh deployment running a version before 4.14.7 that has the ip-customblock active response configured is affected—the sibling scripts host-deny.c, default-firewall-drop.c, and firewalld-drop.c reject non-IP input via get_ip_version(), but ip-customblock.c omits that validation. No exploitation, public proof-of-concept, or CISA KEV listing is known, and EPSS currently estimates a 0.3% probability of exploitation within 30 days (26th percentile).

What to do: Upgrade to Wazuh 4.14.7 or later on any manager or agent where the ip-customblock active response is configured. As an interim mitigation, disable ip-customblock or switch to one of the sibling responses that validate srcip (host-deny, default-firewall-drop, or firewalld-drop), and audit which log sources can generate alert-matching events that invoke it.