{"id":"CVE-2026-17614","aliases":["EUVD-2026-52568","GHSA-62xj-w627-m337"],"status":"published","title":"Wildfly-core: path traversal on wildfly domain controller","description":"A path traversal flaw was found in WildFly's domain mode\n  implementation. The LocalFileRepository.getFile() and\n  getConfigurationFile() methods in\n  wildfly-core/deployment-repository do not validate that the\n  resolved file path remains within the configured repository or\n  configuration root directories. A remote attacker who has\n  obtained the slave host controller secret or compromised a slave\n  host controller can supply a crafted relative path containing\n  directory traversal sequences (e.g., ../../etc/passwd) via the\n  slave-DC wire protocol, causing the Domain Controller to resolve\n  and serve arbitrary files readable by the DC process. This leads\n  to unauthorized disclosure of sensitive information such as\n  configuration files, keystores, and system credentials.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01218,"percentile":0.68865,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-08-04T02:12:04Z","modified":"2026-11-06T17:27:10Z","products":[{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8.1"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat single sign-on 7"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:95887","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-17614","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507631","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17614"},{"url":"https://github.com/advisories/GHSA-62xj-w627-m337"}],"sources":{"cve":[{"id":"CVE-2026-17614","title":"Wildfly-core: path traversal on wildfly domain controller","description":"A path traversal flaw was found in WildFly's domain mode\n  implementation. The LocalFileRepository.getFile() and\n  getConfigurationFile() methods in\n  wildfly-core/deployment-repository do not validate that the\n  resolved file path remains within the configured repository or\n  configuration root directories. A remote attacker who has\n  obtained the slave host controller secret or compromised a slave\n  host controller can supply a crafted relative path containing\n  directory traversal sequences (e.g., ../../etc/passwd) via the\n  slave-DC wire protocol, causing the Domain Controller to resolve\n  and serve arbitrary files readable by the DC process. This leads\n  to unauthorized disclosure of sensitive information such as\n  configuration files, keystores, and system credentials.","status":"published","published":"2026-08-04T02:12:04.774Z","modified":"2026-11-06T17:27:10.982Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-06T18:59:08.498645Z"}],"euvd":[{"id":"EUVD-2026-52568","description":"A path traversal flaw was found in WildFly's domain mode\n  implementation. The LocalFileRepository.getFile() and\n  getConfigurationFile() methods in\n  wildfly-core/deployment-repository do not validate that the\n  resolved file path remains within the configured repository or\n  configuration root directories. A remote attacker who has\n  obtained the slave host controller secret or compromised a slave\n  host controller can supply a crafted relative path containing\n  directory traversal sequences (e.g., ../../etc/passwd) via the\n  slave-DC wire protocol, causing the Domain Controller to resolve\n  and serve arbitrary files readable by the DC process. This leads\n  to unauthorized disclosure of sensitive information such as\n  configuration files, keystores, and system credentials.","status":"published","published":"2026-08-04T02:12:04Z","modified":"2026-11-06T17:27:10Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-06T18:05:39.47551Z"}],"ghsa":[{"id":"GHSA-62xj-w627-m337","title":"A path traversal flaw was found in WildFly's domain mode\n  implementation. The...","description":"A path traversal flaw was found in WildFly's domain mode\n  implementation. The LocalFileRepository.getFile() and\n  getConfigurationFile() methods in\n  wildfly-core/deployment-repository do not validate that the\n  resolved file path remains within the configured repository or\n  configuration root directories. A remote attacker who has\n  obtained the slave host controller secret or compromised a slave\n  host controller can supply a crafted relative path containing\n  directory traversal sequences (e.g., ../../etc/passwd) via the\n  slave-DC wire protocol, causing the Domain Controller to resolve\n  and serve arbitrary files readable by the DC process. This leads\n  to unauthorized disclosure of sensitive information such as\n  configuration files, keystores, and system credentials.","status":"published","published":"2026-08-04T03:31:10Z","modified":"2026-11-06T18:34:29Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-06T19:01:25.944997Z"}],"nvd":[{"id":"CVE-2026-17614","description":"A path traversal flaw was found in WildFly's domain mode\n  implementation. The LocalFileRepository.getFile() and\n  getConfigurationFile() methods in\n  wildfly-core/deployment-repository do not validate that the\n  resolved file path remains within the configured repository or\n  configuration root directories. A remote attacker who has\n  obtained the slave host controller secret or compromised a slave\n  host controller can supply a crafted relative path containing\n  directory traversal sequences (e.g., ../../etc/passwd) via the\n  slave-DC wire protocol, causing the Domain Controller to resolve\n  and serve arbitrary files readable by the DC process. This leads\n  to unauthorized disclosure of sensitive information such as\n  configuration files, keystores, and system credentials.","status":"published","published":"2026-08-04T03:16:25.537Z","modified":"2026-11-06T18:18:09.313Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-06T20:01:12.716992Z"}]}}