Path Traversal Vulnerability in WildFly Core Library Affects JBoss EAP

CVE-2026-85634

What is CVE-2026-85634?

A vulnerability exists in the ContentRepositoryImpl.copyExplodedContent function within the wildfly-core library, utilized by WildFly and JBoss EAP for server management. This flaw arises when the library processes deployment names without adequate sanitization, enabling an attacker with the Deployer role to leverage path traversal sequences. Such exploitation can lead to unauthorized access to files beyond the intended deployment directory, resulting in the potential deletion of arbitrary directories or the creation of files containing unintended content. This may ultimately facilitate a complete privilege escalation to the management SuperUser role.

References