CVE-2026-85634
Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in WildFly and JBoss EAP via WildFly-Core

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description
A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-85634
EUVD
EUVD-2026-102164

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Red Hat Red Hat Fuse 7 *
Red Hat Red Hat JBoss Enterprise Application Platform 7 *
Red Hat Red Hat JBoss Enterprise Application Platform 8 *
Red Hat Red Hat Single Sign-On 7 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, used by WildFly and JBoss EAP. An attacker with the Deployer RBAC role can exploit an unsanitized deployment name to bypass containment checks and access files outside the deployment directory. This allows arbitrary directory deletion or file creation, leading to full privilege escalation to the SuperUser role.

Detection Guidance

Detecting this vulnerability requires checking WildFly or JBoss EAP deployments for path traversal attempts in deployment names. Monitor server logs for unusual file operations or failed containment checks. Look for deployments with suspicious names containing path traversal sequences like ../. Use commands like grep to search logs for 'ContentRepositoryImpl.copyExplodedContent' errors or unauthorized file access attempts.

Impact Analysis

If exploited, this vulnerability allows an attacker to delete critical directories, create arbitrary files, replace the management credential store, and escalate privileges from Deployer to SuperUser. This results in full administrative control over the system, enabling unauthorized code execution, data exposure, and denial-of-service attacks.

Compliance Impact

This vulnerability can lead to unauthorized access, data breaches, and loss of sensitive information, which directly violates compliance requirements of GDPR and HIPAA. Unauthorized privilege escalation and data exposure risk severe penalties, legal consequences, and reputational damage for organizations handling regulated data.

Mitigation Strategies

Immediate mitigation steps include revoking the Deployer RBAC role from untrusted users and restricting deployment permissions. Avoid deploying applications with unsanitized names. Monitor for exploitation attempts and isolate affected systems. Note that Red Hat has not provided stable mitigation options as of the published date.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85634. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart