JBoss EAP CVE-2026-85634

Exploitation requires the attacker to already hold the Deployer RBAC role on the WildFly/JBoss EAP management interface (PR:L - authenticated, not anonymous), and the environment must use RBAC with Deployer privileges delegated to the attacker. The specific trigger is supplying a deployment whose name contains path traversal sequences, which ContentRepositoryImpl.copyExplodedContent processes without a containment check. Limiting factors: this is not exploitable by unauthenticated users or by roles below Deployer; environments that do not delegate the Deployer role to semi-trusted principals, or that run a single trusted SuperUser, face little practical exposure since such a user already has full control. No special non-default product feature beyond standard deployment management and RBAC is needed.

This is a credible, actionable priority rather than a CVSS-inflated paper risk, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high impact to confidentiality, integrity, and availability - consistent with the description of a Deployer-role user leveraging path traversal (CWE-22) in wildfly-core's ContentRepositoryImpl.copyExplodedContent to delete arbitrary directories or write arbitrary files and escalate to the management SuperUser role. The key mitigating signal is PR:L: this is NOT an unauthenticated attack. An attacker must already hold the Deployer RBAC role on the management interface, so the realistic threat is a malicious or compromised lower-privileged administrator/operator escalating to full control, not an anonymous internet attacker. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the absence of these signals should not be read as safety, only as a lack of data. One modeling tension worth noting: the described outcome is full privilege escalation from Deployer to SuperUser, which arguably represents a security-scope change (S:C), yet the supplied vector uses S:U - if S:C were applied the score would rise further, so the real impact may be understated by the input vector. Overall: patch promptly in environments where Deployer roles are delegated to semi-trusted users, but immediate panic is not warranted absent exploitation evidence.

An operator who has been granted only the Deployer RBAC role in a WildFly or JBoss EAP management domain submits a deployment whose name contains path traversal sequences (e.g. ../../). Because ContentRepositoryImpl.copyExplodedContent fails to confirm the resolved path stays within the deployment directory, the operation writes attacker-controlled files or deletes directories outside the sandbox, which the attacker uses to overwrite management configuration and elevate to the SuperUser role. No public exploit code was provided in the input, and the low attack complexity (AC:L) means a working exploit would be straightforward to develop once the Deployer role is held.