Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-10-15T00:00:00 wildfly-core: wildfly-core: Deployer RBAC role privilege escalation via path traversal in deployment name 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-22

A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.

A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.

The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it allows for privilege escalation from a restricted role to full administrative control. Successful exploitation allows an attacker to delete arbitrary directories and create files with arbitrary content, such as replacing the management credential store. The vulnerability root cause is a missing containment check in the ContentRepositoryImpl.copyExplodedContent function allowing path traversal via unsanitized deployment names. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Fuse 7 Affected wildfly-server Red Hat JBoss Enterprise Application Platform 7 Will not fix jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Will not fix jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Will not fix jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Will not fix wildfly-server Red Hat JBoss Enterprise Application Platform 8 Affected wildfly-server Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected wildfly-server Red Hat Single Sign-On 7 Will not fix wildfly-server https://www.cve.org/CVERecord?id=CVE-2026-85634 https://nvd.nist.gov/vuln/detail/CVE-2026-85634