{"id":"CVE-2026-24330","revision":"1b2053af75804c4ba03eeb5f36b2c3ee","records":[{"revision":"1b2053af75804c4ba03eeb5f36b2c3ee","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-24330","aliases":[],"title":"Wildfly-core: wildfly: arbitrary file read via malicious archive deployment","description":"A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.","state":0,"publishedAt":"2026-08-11T02:35:22.539+00:00","modifiedAt":"2026-08-11T16:05:24.21+00:00","affected":[{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"wildfly-core-security","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Fuse 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"wildfly-core-security\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_fuse:7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"wildfly-core-security","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Enterprise Application Platform 7\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"wildfly-core-security\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_enterprise_application_platform:7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"wildfly-core-security","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Enterprise Application Platform 8\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"wildfly-core-security\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_enterprise_application_platform:8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"wildfly-core-security","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"wildfly-core-security\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jbosseapxp\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"wildfly-core-security","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Process Automation 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"wildfly-core-security\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"wildfly-core-security","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Single Sign-On 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"wildfly-core-security\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:red_hat_single_sign_on:7\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://access.redhat.com/security/cve/CVE-2026-24330","https://bugzilla.redhat.com/show_bug.cgi?id=2431939"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-24330","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-24330","identifiers":["CVE-2026-24330"]},"retained":false,"historicalAffected":[]}],"coverage":[]}