Bug 2527902 (CVE-2026-84823)

Summary: CVE-2026-84823 org.wildfly.core: WildFly: Path traversal in take-snapshot discloses the server configuration to the Monitor role
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, gmalinko, istudens, ivassile, iweiss, janstey, mosmerov, mposolda, msvehla, nwallace, pberan, pdelbell, pesilva, pjindal, pmackay, rhel-process-autobot, rmartinc, rstancel, rstepani, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-03 09:33:49 UTC 
There is a flaw in WildFly that allows`take-snapshot` to write a copy of the server configuration to a file the caller names. It takes two parameters that become part of that filename, `comment` and `name`, and it sanitizes only `comment`. A `name` of `../../../../welcome-content/x-` therefore drops the configuration wherever the caller likes.

The operation is available to `Monitor`, the lowest standard RBAC role, and that is deliberate. What is not deliberate is that `Monitor` can now choose a destination it is able to read back. RBAC refuses that role the configuration as a document, and refuses it the credentials inside the configuration. A snapshot is both, byte for byte.