CVE-2026-85634
8.8HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-22
Impact
An authenticated user with the Deployer RBAC role can delete arbitrary directories or write arbitrary files, escalating privileges to management SuperUser. Exploitation requires network access to the WildFly/JBoss management interface and valid Deployer credentials.
Root cause
The ContentRepositoryImpl.copyExplodedContent function fails to sanitize deployment names and lacks a containment check, allowing path traversal sequences.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade wildfly-core/WildFly/JBoss EAP to a patched version once published by Red Hat; in the interim, revoke the Deployer role from untrusted users and restrict access to the management console and API.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.