---
id: CVE-2026-84823
title: >-
  Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the
  server configuration to the monitor role
summary: >-
  A flaw was found in WildFly. A user with the `Monitor` role, which is the
  lowest standard Role-Based Access Control (RBAC) role, can exploit a path
  traversal vulnerability in the `take-snapshot` operation. By manipulating the
  `name` para…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: Red Hat
product: 'pki-core:10.6/resteasy'
affected:
  - 'pki-core:10.6/resteasy'
  - 'pki-deps:10.6/resteasy'
  - resteasy
  - wildfly-cli (all versions)
  - wildfly-controller (all versions)
  - wildfly-controller-client (all versions)
  - wildfly-core-galleon-pack (all versions)
  - wildfly-core-management-client (all versions)
  - wildfly-core-management-subsystem (all versions)
  - wildfly-core-security
  - wildfly-core-security-api (all versions)
  - wildfly-deployment-repository (all versions)
  - wildfly-deployment-scanner (all versions)
  - wildfly-discovery (all versions)
  - wildfly-domain-http-error-context (all versions)
  - wildfly-domain-http-interface (all versions)
  - wildfly-domain-management (all versions)
  - wildfly-elytron-integration (all versions)
  - wildfly-elytron-tool-wrapper (all versions)
  - wildfly-embedded (all versions)
  - wildfly-event-logger (all versions)
  - wildfly-host-controller (all versions)
  - wildfly-io (all versions)
  - wildfly-jmx (all versions)
  - wildfly-launcher (all versions)
  - wildfly-logging (all versions)
  - wildfly-management-client-content (all versions)
  - wildfly-model-test (all versions)
  - wildfly-network (all versions)
  - wildfly-patching (all versions)
  - wildfly-platform-mbean (all versions)
  - wildfly-process-controller (all versions)
  - wildfly-protocol (all versions)
  - wildfly-remoting (all versions)
  - wildfly-request-controller (all versions)
  - wildfly-security-manager (all versions)
  - wildfly-self-contained (all versions)
  - wildfly-server (all versions)
  - wildfly-subsystem-test-framework (all versions)
  - wildfly-threads (all versions)
  - wildfly-version (all versions)
  - jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)
  - jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)
  - jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)
  - wildfly-cli (all versions)
  - wildfly-controller (all versions)
  - wildfly-controller-client (all versions)
  - wildfly-core-build (all versions)
  - wildfly-core-build-legacy (all versions)
  - wildfly-core-component-matrix-builder (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T16:31:49.890938Z'
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:07:53.314Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-84823'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-84823'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2527902'
    label: RHBZ#2527902
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84823.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-84823'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84823'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00342
epssPercentile: 0.26087
ingestedAt: '2026-10-15T23:54:16.910Z'
---

## Overview

A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.

## Affected

- `pki-core:10.6/resteasy`
- `pki-deps:10.6/resteasy`
- `resteasy`
- `wildfly-cli (all versions)`
- `wildfly-controller (all versions)`
- `wildfly-controller-client (all versions)`
- `wildfly-core-galleon-pack (all versions)`
- `wildfly-core-management-client (all versions)`
- `wildfly-core-management-subsystem (all versions)`
- `wildfly-core-security`
- `wildfly-core-security-api (all versions)`
- `wildfly-deployment-repository (all versions)`
- `wildfly-deployment-scanner (all versions)`
- `wildfly-discovery (all versions)`
- `wildfly-domain-http-error-context (all versions)`
- `wildfly-domain-http-interface (all versions)`
- `wildfly-domain-management (all versions)`
- `wildfly-elytron-integration (all versions)`
- `wildfly-elytron-tool-wrapper (all versions)`
- `wildfly-embedded (all versions)`
- `wildfly-event-logger (all versions)`
- `wildfly-host-controller (all versions)`
- `wildfly-io (all versions)`
- `wildfly-jmx (all versions)`
- `wildfly-launcher (all versions)`
- `wildfly-logging (all versions)`
- `wildfly-management-client-content (all versions)`
- `wildfly-model-test (all versions)`
- `wildfly-network (all versions)`
- `wildfly-patching (all versions)`
- `wildfly-platform-mbean (all versions)`
- `wildfly-process-controller (all versions)`
- `wildfly-protocol (all versions)`
- `wildfly-remoting (all versions)`
- `wildfly-request-controller (all versions)`
- `wildfly-security-manager (all versions)`
- `wildfly-self-contained (all versions)`
- `wildfly-server (all versions)`
- `wildfly-subsystem-test-framework (all versions)`
- `wildfly-threads (all versions)`
- `wildfly-version (all versions)`
- `jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)`
- `jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)`
- `jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)`
- `wildfly-cli (all versions)`
- `wildfly-controller (all versions)`
- `wildfly-controller-client (all versions)`
- `wildfly-core-build (all versions)`
- `wildfly-core-build-legacy (all versions)`
- `wildfly-core-component-matrix-builder (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, restrict access to the WildFly management interface to trusted networks and users. Implement firewall rules to limit network reachability to the management ports. Additionally, review existing Role-Based Access Control (RBAC) assignments within WildFly and ensure that users are granted only the minimum necessary privileges, adhering to the principle of least privilege. Reviewing role assignments might impact functionality if users genuinely require the `Monitor` role for their operations.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7 · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 8, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84823.json)