CVE-2025-30201: wazuh External Control of File Name or Path
Vulnerability summary
CVE-2025-30201 is a critical (CVSS 9.1) External Control of File Name or Path vulnerability in wazuh. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 21-11-2025PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings, potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA7.7HighCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:NDiffers
EPSS trend
Probability
0.76%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
-0.01 pp
From 0.77% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundWazuh
Maturity: poc
Weaknesses
CWE · root cause- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
Affected systems
Wazuh1 product
- wazuh< 4.13.0
1 vendor · 1 product
References
3 links- github.com/wazuh/wazuh/security/advisories/GHSA-x697-jf34-gp5xX Refsource CONFIRMExploitVendor Advisory