EUVD-2026-52568
GHSA-62xj-w627-m337
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Network vector via slave-DC protocol; AC:H and PR:H because attacker must already possess or have compromised slave HC credentials; confidentiality-only impact with no integrity or availability effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A remote attacker who has obtained the slave host controller secret or compromised a slave host controller can supply a crafted relative path containing directory traversal sequences (e.g., ../../etc/passwd) via the slave-DC wire protocol, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information such as configuration files, keystores, and system credentials.
AnalysisAI
Path traversal in WildFly's domain mode LocalFileRepository exposes arbitrary files readable by the Domain Controller process to attackers who have already obtained or compromised a slave host controller. The flaw resides in the wildfly-core/deployment-repository component, where getFile() and getConfigurationFile() fail to canonicalize or bound-check caller-supplied paths before resolving them on disk, enabling directory traversal sequences to escape the configured repository root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions simultaneously: (1) WildFly or JBoss EAP must be deployed in domain mode - standalone mode deployments are not affected because the slave-DC wire protocol and LocalFileRepository are domain-mode-only components; (2) the attacker must have already obtained the slave host controller shared secret, OR must have achieved compromise of an existing slave host controller node; (3) the attacker must have network reachability to the Domain Controller's management interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) accurately reflects the constrained exploitability of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained the WildFly slave host controller shared secret - either through credential theft, misconfiguration, or by compromising an existing slave HC - connects to the Domain Controller's management interface using the slave-DC wire protocol. The attacker then invokes a file retrieval operation with a crafted relative path such as '../../../../etc/shadow' or '../../../opt/wildfly/standalone/configuration/application-users.properties', causing the Domain Controller's JVM to resolve the path outside the repository root and transmit the file contents back to the attacker. … |
| Remediation | Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-17614 for the definitive patched release version, as exact fixed version numbers were not available in the input data at time of analysis - patch status should be treated as 'Patch available per vendor advisory' pending Red Hat's formal release notes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archive
Cross-site scripting in Jastow - the JSP implementation layer embedded within Red Hat JBoss Enterprise Application Platf
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-syn
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing
Denial of service in WildFly Core (and downstream Red Hat middleware products) allows a remote administrative user to re
The AdvertiseListenerImpl component in mod_cluster's core multicast UDP handler can be permanently crashed by a single c
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today