There is a flaw in WildFly that allows`take-snapshot` to write a copy of the server configuration to a file the caller names. It takes two parameters that become part of that filename, `comment` and `name`, and it sanitizes only `comment`. A `name` of `../../../../welcome-content/x-` therefore drops the configuration wherever the caller likes.

The operation is available to `Monitor`, the lowest standard RBAC role, and that is deliberate. What is not deliberate is that `Monitor` can now choose a destination it is able to read back. RBAC refuses that role the configuration as a document, and refuses it the credentials inside the configuration. A snapshot is both, byte for byte.