---
id: CVE-2026-17614
title: 'Wildfly-core: path traversal on wildfly domain controller'
summary: |-
  A path traversal flaw was found in WildFly's domain mode
    implementation. The LocalFileRepository.getFile() and
    getConfigurationFile() methods in
    wildfly-core/deployment-repository do not validate that the
    resolved file path remai…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: Red Hat
product: wildfly-deployment-repository
affected:
  - wildfly-deployment-repository
  - >-
    eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8 (all
    versions)
  - >-
    eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8 (all
    versions)
  - >-
    eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8 (all
    versions)
  - >-
    jboss-eap-7-eap74-els-openjdk17-openshift-rhel8/jboss-eap-7-eap74-els-openjdk17-openshift-rhel8
    (all versions)
  - >-
    jboss-eap-7-eap74-els-openjdk8-openshift-rhel8/jboss-eap-7-eap74-els-openjdk8-openshift-rhel8
    (all versions)
  - wildfly-deployment-repository (all versions)
  - wildfly-deployment-repository (all versions)
  - wildfly-deployment-repository (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-04T14:47:19.869194Z'
published: '2026-08-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:27:10.982Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-17614'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:95887'
    label: 'RHSA-2026:95887'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-17614'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507631'
    label: RHBZ#2507631
tags:
  - cve.org
epss: 0.01218
epssPercentile: 0.68792
ingestedAt: '2026-11-06T18:00:12.517Z'
---

## Overview

A path traversal flaw was found in WildFly's domain mode
  implementation. The LocalFileRepository.getFile() and
  getConfigurationFile() methods in
  wildfly-core/deployment-repository do not validate that the
  resolved file path remains within the configured repository or
  configuration root directories. A remote attacker who has
  obtained the slave host controller secret or compromised a slave
  host controller can supply a crafted relative path containing
  directory traversal sequences (e.g., ../../etc/passwd) via the
  slave-DC wire protocol, causing the Domain Controller to resolve
  and serve arbitrary files readable by the DC process. This leads
  to unauthorized disclosure of sensitive information such as
  configuration files, keystores, and system credentials.

## Affected

- `wildfly-deployment-repository`
- `eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8 (all versions)`
- `eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8 (all versions)`
- `eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8 (all versions)`
- `jboss-eap-7-eap74-els-openjdk17-openshift-rhel8/jboss-eap-7-eap74-els-openjdk17-openshift-rhel8 (all versions)`
- `jboss-eap-7-eap74-els-openjdk8-openshift-rhel8/jboss-eap-7-eap74-els-openjdk8-openshift-rhel8 (all versions)`
- `wildfly-deployment-repository (all versions)`
- `wildfly-deployment-repository (all versions)`
- `wildfly-deployment-repository (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.