CVE-2021-26814: 
JavaScript vulnerability analysis and mitigation

CVE-2021-26814 is a path traversal vulnerability affecting Wazuh API versions 4.0.0 to 4.0.3. The vulnerability allows authenticated users to execute arbitrary code with administrative privileges via the /manager/files and /cluster/{node_id}/files endpoints. This security flaw was discovered and reported by Davide Meacci (Wazuh Release Notes).

The vulnerability stems from incomplete input validation on the /manager/files API, which could be exploited to inject arbitrary code within the API service script. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and requiring low privileges (NVD).

The vulnerability allows authenticated attackers to execute arbitrary code with administrative privileges, potentially leading to complete system compromise. The high CVSS score reflects the severe potential impact on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires authentication but has low attack complexity, making it relatively straightforward to exploit for authenticated users. The attack can be performed remotely through network access to the affected API endpoints (NVD).

The vulnerability was fixed in Wazuh version 4.0.4. Organizations should upgrade to this version or later to address the security issue. The fix includes improved input validation and additional security headers for API responses (Wazuh GitHub).