CVE-2026-84823— Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 8
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 WildFly 中发现了一个漏洞。具有 角色（这是基于角色的访问控制（RBAC）中最低的默认角色）的用户可以利用 操作中的路径遍历漏洞。通过操纵 参数，该用户可以将服务器配置的副本写入任意位置。这使得 角色能够回读服务器配置，包括敏感凭据，而这些凭据本应受 RBAC 限制，从而导致信息泄露。
Possible ATT&CK Techniques 3 AI
T1552 · Unsecured Credentials T1059 · Command and Scripting Interpreter T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84823
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat Fuse 7 | - |
cpe:/a:redhat:jboss_fuse:7
|
|
II. Public POCs for CVE-2026-84823
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84823
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-84823 (2)
Same Patch Batch · Red Hat · 2026-10-15 · 10 CVEs total
| CVE-2026-85634 | 8.8 HIGH | Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in |
| CVE-2026-92982 | 8.5 HIGH | Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 te |
| CVE-2026-108334 | 7.4 HIGH | Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-ope |
| CVE-2026-110923 | 6.5 MEDIUM | Openssh: openssh: sftp can write outside the destination directory from a server-supplied |
| CVE-2026-109131 | 5.4 MEDIUM | Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection modu |
| CVE-2026-110925 | 5.4 MEDIUM | Openssh: openssh: '$' and '\' in a command-line username expand through %u |
| CVE-2026-110926 | 5.3 MEDIUM | Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels |
| CVE-2026-110924 | 4.8 MEDIUM | Openssh: openssh: gssapi delegated credentials can be stored after a failed authentication |
| CVE-2026-110927 | 4.3 MEDIUM | Openssh: openssh: a compressed payload can expand past the maximum packet size |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 8
-
CVE-2026-91926
Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_ -
CVE-2026-74859
Gnome-tweaks: path traversal in theme installer -
CVE-2026-79992
Emacs: emacs: command injection via crafted filenames in tra -
CVE-2026-16445
Dracut: dracut: root code execution via dhcp options command -
CVE-2026-58380
Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()
Same vendor: Red Hat
-
CVE-2026-104715
Cifs-utils: mount.cifs credential-file option injection allo -
CVE-2026-109131
Ansible-ui: ansible-ui: stored xss via unsafe javascript url -
CVE-2026-108334
Github.com/kuadrant/kuadrant-operator/internal/wasm: github. -
CVE-2026-85634
Wildfly-core: wildfly-core: deployer rbac role privilege esc -
CVE-2026-92982
Ansible-operator-plugins: ansible operator plugins: arbitrar
Same weakness: CWE-22
-
CVE-2026-103896
10Web Booster <= 2.34.5 - Unauthenticated Limited File Write -
CVE-2026-93767
Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Travers -
CVE-2026-109221
Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) -
CVE-2026-104769
Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via ' -
CVE-2026-108452
Microsoft Office SharePoint Remote Code Execution Vulnerabil
V. Comments for CVE-2026-84823
No comments yet