WildFly: Path traversal in take-snapshot discloses server configuration
Summary
A flaw in the WildFly management API allows an authenticated user with the Monitor role to exploit a path traversal in the take-snapshot operation by manipulating the name parameter. The user can write a copy of the server configuration to an arbitrary location and read it back, which exposes sensitive credentials that RBAC would otherwise restrict. The attack requires a valid low-privileged account, and the vendor rates the impact as Low, while NVD/CNA CVSS is 7.1 (High).
Affected
- Red Hat Enterprise Linux 8 and 9: default unaffected according to the CVE record.
- Red Hat Fuse 7: default affected for several entries according to the CVE record.
- Affected WildFly versions: Unknown.
- Red Hat JBoss EAP 7 and 8, Single Sign-On 7: listed as affected by a third-party tracker, not confirmed by Red Hat.
Fixed in
- Upstream fix: WildFly Core 34.0.0.Final (WFCORE-7729).
- Red Hat errata and fixed EAP, SSO and Fuse versions: Unknown.
- An unofficial backport to WildFly Core 28.0.1 exists but is not a vendor release.
Workaround
- Restrict access to the WildFly management interface to trusted networks and users.
- Limit network reachability to the management ports with firewall rules.
- Review Monitor and other RBAC role assignments and apply least privilege; this may affect operations that rely on the Monitor role.
Exploitation
- CISA KEV: not listed.
- Public proof of concept: none found in the trackers reviewed.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Confirm whether WildFly, EAP, SSO or Fuse instances are in use and identify their exact versions.
- Ensure the management interface is not reachable from the internet and limit it to admin networks.
- Audit accounts with the Monitor role and remove unneeded ones.
- Apply the Red Hat errata once fixed versions are confirmed, or move to a WildFly Core 34.0.0.Final-based release.
- If the server may have been exposed, rotate credentials stored in the configuration such as datasources and security realms.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-84823 access.redhat.com
- Red Hat Bugzilla 2527902 bugzilla.redhat.com
- WildFly Core 34.0.0.Final release github.com
- WildFly pull request 20530 github.com
- VulDB CVE-2026-84823 vuldb.com
- OpenCVE CVE-2026-84823 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 12:54.
Original description (NVD)
A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.