CVE-2026-49392: 
Wazuh Server vulnerability analysis and mitigation

CVE-2026-49392 is a local SQL injection vulnerability in Wazuh's File Integrity Monitoring (FIM) subsystem, specifically in the wazuh-syscheckd daemon. Affecting Wazuh versions 4.6.0 through 4.14.5 and 5.0.0-beta1 through 5.0.0-beta2 on non-Windows systems, the flaw allows a local user with write access to a FIM-monitored directory to inject SQLite UNION SELECT expressions by crafting a malicious filename. The vulnerability was reported by researcher 'pruiz' and published on August 19, 2026, with fixes released in versions 4.14.6 and 5.0.0-beta3. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is improper input validation and SQL injection (CWE-20, CWE-89) in src/syscheckd/src/db/src/file.cpp. The functions DB::getFile() and DB::searchFile() concatenate a monitored file path directly into SQLite row filter strings (e.g., WHERE path="<path>") without sanitization. On non-Windows platforms, FIMDBCreator::encodeString() is a no-op — it performs no escaping — leaving the path value unprotected before it is passed to sqlite3_prepare_v2() and executed. An attacker creates a filename containing a UNION SELECT payload in a FIM-monitored directory; when wazuh-syscheckd processes or deletes that file, the crafted path is interpolated into the SQLite query, causing the injected SELECT to execute. The confirmed exploitation primitive is result-set manipulation; stacked statements and remote code execution were not demonstrated (GitHub Advisory, Fix PR).

Successful exploitation allows a local attacker to inject attacker-controlled SQLite expressions into FIM database SELECT queries, manipulate the result sets consumed by wazuh-syscheckd, and inject fabricated rows into FIM event data — potentially causing false or suppressed integrity alerts. Additional impacts include potential denial of service through expensive SQLite expressions or oversized result fields, and possible queue-send failures or event loss if a very large injected path value reaches the internal queue socket. The vulnerability does not affect confidentiality of data outside the local FIM SQLite database, and remote code execution was not demonstrated (GitHub Advisory).

A proof-of-concept was included in the original security advisory, demonstrating successful UNION SELECT injection via a crafted filename. The NVD SSVC assessment confirms exploitation status as 'poc'. The vulnerability requires local access and write permissions to a FIM-monitored directory, making it non-automatable and limiting its attack surface. The EPSS score is 0.0, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. No in-the-wild exploitation or threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a system running a vulnerable Wazuh agent (versions 4.6.0–4.14.5 or 5.0.0-beta1/beta2) on a non-Windows OS. Confirm that FIM is configured and identify which directories are monitored (typically defined in ossec.conf under <directories>).
2. Gain local access: Obtain a local user account with write access to a FIM-monitored directory (e.g., /tmp/wazuh-fim-test).
3. Craft malicious filename: Create a file whose name contains a UNION SELECT payload matching the column count and types of the file_entry table. Example:

touch '/tmp/wazuh-fim-test/pwn" UNION SELECT char(47)||"tmp"||char(47)||"wazuh-fim-test"||char(47)||"INJECTED_PATH",33188,1,1,0,"checksum",1,12345,123,"rw-r--r--","", "0","0","root","root","a","a","a",0 -- '

4. Trigger FIM processing: Wait for wazuh-syscheckd to scan the directory (per configured scan frequency), or delete the file to trigger a deletion event. The daemon will interpolate the filename into a SQLite query.
5. Observe injection: The injected UNION SELECT is prepared and executed by SQLite. The fabricated row is consumed by the FIM result-handling code, potentially generating a spoofed FIM event sent to the internal queue socket (GitHub Advisory, Fix PR).

• File System: Presence of files with unusual names containing SQL keywords such as UNION, SELECT, --, or quote characters in FIM-monitored directories.
• Logs: wazuh-syscheckd log entries containing json.exception.type_error.302 errors (e.g., type must be string, but is number or type must be number, but is string), which may indicate type mismatches caused by injected rows with incorrect column types.
• Logs: SQLite error messages such as SELECTs to the left and right of UNION do not have the same number of result columns appearing in the Wazuh agent log, indicating a failed or malformed injection attempt.
• FIM Events: Unexpected or fabricated FIM alert events referencing file paths that do not exist on the filesystem, or paths with anomalous characters (GitHub Advisory).

Wazuh has released patched versions 4.14.6 and 5.0.0-beta3, which migrate FIM database path queries from string concatenation to parameterized SQLite statements using ? placeholders and bound parameters, fully eliminating the injection vector. No configuration-based workaround is available; upgrading to a patched version is the only remediation. Organizations unable to upgrade immediately should restrict write access to FIM-monitored directories to trusted users only, reducing the attack surface (Wazuh v4.14.6 Release, Wazuh v5.0.0-beta3 Release, Fix PR).

The vulnerability was reported by independent researcher 'pruiz' and acknowledged by the Wazuh security team, who assessed it as Moderate severity. The fix was developed by Wazuh contributor Darioortegaleyva and reviewed by MarcelKemp, with the PR merged on May 25, 2026. The reporter noted the issue as Medium to Low severity given the local access requirement and the absence of demonstrated RCE or stacked statement execution (GitHub Advisory).