Bug 2528476 (CVE-2026-85634)

Summary: CVE-2026-85634 wildfly-core: wildfly-core: Deployer RBAC role privilege escalation via path traversal in deployment name
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, gmalinko, istudens, ivassile, iweiss, janstey, mosmerov, mposolda, msvehla, nwallace, pberan, pdelbell, pesilva, pjindal, pmackay, rmartinc, rstancel, rstepani, security-response-team, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-10-15   

Description OSIDB Bzimport 2026-09-04 11:51:02 UTC 
A path traversal vulnerability was found in WildFly Core within the ContentRepositoryImpl.copyExplodedContent function. The root cause is a missing containment check when handling deployment names, allowing an attacker to provide a specially crafted name containing path traversal sequences. An attacker authenticated with the Deployer RBAC role can exploit this flaw to escape the deployment content repository. Successful exploitation allows the attacker to perform arbitrary file system operations, such as deleting arbitrary directories and creating files with arbitrary content. This can be used to replace the management credential store, effectively escalating privileges from the Deployer role to management SuperUser.