{"id":"CVE-2026-17614","title":"Wildfly-core: path traversal on wildfly domain controller","summary":"A path traversal flaw was found in WildFly's domain mode\n  implementation. The LocalFileRepository.getFile() and\n  getConfigurationFile() methods in\n  wildfly-core/deployment-repository do not validate that the\n  resolved file path remai…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-22"],"vendor":"Red Hat","product":"wildfly-deployment-repository","affected":["wildfly-deployment-repository","eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8 (all versions)","eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8 (all versions)","eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8 (all versions)","jboss-eap-7-eap74-els-openjdk17-openshift-rhel8/jboss-eap-7-eap74-els-openjdk17-openshift-rhel8 (all versions)","jboss-eap-7-eap74-els-openjdk8-openshift-rhel8/jboss-eap-7-eap74-els-openjdk8-openshift-rhel8 (all versions)","wildfly-deployment-repository (all versions)","wildfly-deployment-repository (all versions)","wildfly-deployment-repository (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-04T14:47:19.869194Z"},"published":"2026-08-04","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:27:10.982Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-17614","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:95887","label":"RHSA-2026:95887"},{"url":"https://access.redhat.com/security/cve/CVE-2026-17614"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507631","label":"RHBZ#2507631"}],"tags":["cve.org"],"epss":0.01218,"epssPercentile":0.68792,"ingestedAt":"2026-11-06T18:00:12.517Z","slug":"CVE-2026-17614","body":"## Overview\n\nA path traversal flaw was found in WildFly's domain mode\n  implementation. The LocalFileRepository.getFile() and\n  getConfigurationFile() methods in\n  wildfly-core/deployment-repository do not validate that the\n  resolved file path remains within the configured repository or\n  configuration root directories. A remote attacker who has\n  obtained the slave host controller secret or compromised a slave\n  host controller can supply a crafted relative path containing\n  directory traversal sequences (e.g., ../../etc/passwd) via the\n  slave-DC wire protocol, causing the Domain Controller to resolve\n  and serve arbitrary files readable by the DC process. This leads\n  to unauthorized disclosure of sensitive information such as\n  configuration files, keystores, and system credentials.\n\n## Affected\n\n- `wildfly-deployment-repository`\n- `eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8 (all versions)`\n- `eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8 (all versions)`\n- `eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8 (all versions)`\n- `jboss-eap-7-eap74-els-openjdk17-openshift-rhel8/jboss-eap-7-eap74-els-openjdk17-openshift-rhel8 (all versions)`\n- `jboss-eap-7-eap74-els-openjdk8-openshift-rhel8/jboss-eap-7-eap74-els-openjdk8-openshift-rhel8 (all versions)`\n- `wildfly-deployment-repository (all versions)`\n- `wildfly-deployment-repository (all versions)`\n- `wildfly-deployment-repository (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}