CVE-2026-17614 Wildfly-core: path traversal on wildfly domain controller
Remote attackers with slave host controller access can exploit path traversal in WildFly domain mode to read arbitrary sensitive files from the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-17614?
CVE-2026-17614 is a medium-severity path traversal vulnerability in Red Hat JBoss Enterprise Application Platform 7, published on 4 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A remote attacker who has obtained the slave host controller secret or compromised a slave host controller can supply a crafted relative path containing directory traversal sequences (e.g., ../../etc/passwd) via the slave-DC wire protocol, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information such as configuration files, keystores, and system credentials.
Weakness: CWE-22
Which versions are affected by CVE-2026-17614?
How do I fix CVE-2026-17614?
No fix has been published for CVE-2026-17614 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-17614 being exploited?
There is no known exploitation of CVE-2026-17614 in the wild and no public exploit code.
Sources
Also known as GHSA-62xj-w627-m337.