Path traversal in Wildfly Core - CVE-2026-85634
Published: October 26, 2026
Vulnerability details
The vulnerability allows a remote user to escalate privileges to the management SuperUser role and compromise the confidentiality, integrity, and availability of the affected server.
The vulnerability exists due to path traversal in WildFly Core's ContentRepositoryImpl.copyExplodedContent function when processing deployment names without verifying that the resolved destination remains within the intended deployment directory. A remote user can submit a deployment name containing path traversal sequences through management access with the Deployer RBAC role to delete directories and create files containing controlled content outside the intended directory, potentially replacing management credentials and escalating privileges to the management SuperUser role.