CVE-2026-24330 Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

Description

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.

Exploitable remotely over the network, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Network

Attack complexity

Low

Privileges required

High

Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected products and versions