CVE-2026-24330: Wildfly-core: wildfly: arbitrary file read via malicious archive deployment
A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.
Other sources
A remote user authenticated as ‘deployer’ account can import and deploy a malicious archive file from an untrusted source outside the intended control environment. In this specific case, the attacker leveraged WildFly (open source) libraries to craft a Java project that enabled them to perform an HTTP POST request to upload and deploy the malicious archive file from the untrusted source. In this particular scenario, the archive file is a WAR that contains a “read.jsp” page. Once the attacker uploads this file, they can leverage it to exploit other vulnerabilities, such as Arbitrary File Read, as dimostrated in this case.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24330?
The severity of CVE-2026-24330 is ranked as medium with a score of 6.5.
How can CVE-2026-24330 be mitigated?
To mitigate CVE-2026-24330, ensure that deployer accounts are only used for trusted sources and implement strict validation on uploaded files.
What impact does CVE-2026-24330 have on systems?
CVE-2026-24330 allows a remote attacker to read arbitrary files on the server by deploying a malicious archive.
Is CVE-2026-24330 exploitable without authentication?
No, CVE-2026-24330 requires the attacker to be authenticated as a 'deployer' account to exploit the vulnerability.
What type of vulnerability is CVE-2026-24330 classified as?
CVE-2026-24330 is classified as a Malicious File Upload vulnerability.