CVE-2026-85634
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A flaw in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, used by WildFly and JBoss EAP for deployment management, allows an attacker with the Deployer RBAC role to use path traversal sequences to access files outside the deployment directory. This can lead to deletion of arbitrary directories or creation of files with arbitrary content, resulting in full privilege escalation to the SuperUser role.
Risk Assessment
An attacker could gain full control over the application server, deleting or modifying files and escalating privileges to administrator level.
Recommendation
Update WildFly/JBoss EAP to a version containing the fix for this vulnerability in the wildfly-core library.
Other vulnerabilities in wildfly-core
See all- CVE-2026-24330Medium
A flaw in wildfly-core allows a remote attacker authenticated as a 'deployer' account to import and deploy a malicious archive from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive.
- CVE-2026-24329Medium
A flaw in wildfly-core allows a remote user with administrative privileges to inject a malformed payload into the Inet Address field through the Management Model. This causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file.
- CVE-2023-4061Medium
A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.
Original NVD description (English source)
A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS