---
id: CVE-2026-85634
title: >-
  A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of
  the wildfly-core library, which is used by WildFly and JBoss EAP to manage
  server deployments
summary: >-
  A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of
  the wildfly-core library, which is used by WildFly and JBoss EAP to manage
  server deployments. The issue occurs when the library processes an unsanitized
  deplo…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
vendor: Red Hat
product: wildfly-server
affected:
  - wildfly-server (all versions)
  - jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)
  - jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)
  - jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)
  - wildfly-server (all versions)
  - wildfly-server (all versions)
  - wildfly-server
  - wildfly-server (all versions)
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T18:17:30.370'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85634'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-85634'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2528476'
    label: secalert@redhat.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T17:45:29.329011Z'
ingestedAt: '2026-10-15T17:18:20.102Z'
---

## Overview

A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.