SB2026102630 - Multiple vulnerabilities in Wildfly Core

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102630

SB2026102630 - Multiple vulnerabilities in Wildfly Core

Published: October 26, 2026

Security Bulletin ID SB2026102630
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2026-84823)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass role-based access restrictions and disclose sensitive server configuration, including stored credentials.

The vulnerability exists due to path traversal in WildFly Core's filesystem-backed configuration persistence when processing the name parameter of the take-snapshot management operation. A remote user can supply directory traversal sequences, such as name="../../../../welcome-content/x-", to copy the server configuration outside the intended snapshot directory and disclose its contents if the destination permits retrieval.

Exploitation requires a traversal destination writable by the server process.


2) Path traversal (CVE-ID: CVE-2026-85634)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges to the management SuperUser role and compromise the confidentiality, integrity, and availability of the affected server.

The vulnerability exists due to path traversal in WildFly Core's ContentRepositoryImpl.copyExplodedContent function when processing deployment names without verifying that the resolved destination remains within the intended deployment directory. A remote user can submit a deployment name containing path traversal sequences through management access with the Deployer RBAC role to delete directories and create files containing controlled content outside the intended directory, potentially replacing management credentials and escalating privileges to the management SuperUser role.


Remediation

Install update from vendor's website.

References