CVE-2026-24330
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A flaw in wildfly-core allows a remote attacker authenticated as a 'deployer' account to import and deploy a malicious archive from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive.
Risk Assessment
This could lead to further exploitation, such as arbitrary file read vulnerabilities, potentially resulting in data confidentiality and system integrity breaches.
Recommendation
Restrict 'deployer' account privileges and implement mechanisms to verify the origin of archives before deployment.
Original NVD description (English source)
A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.