Vulnerability · Published Aug 11, 2026 · Assigned by redhat

CVE-2026-24330Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

Medium 6.5

In plain English

A medium-severity unrestricted file upload in Red Hat Fuse 7 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 55.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Fuse 7	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 7	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	see references
Red Hat	Red Hat Process Automation 7	see references
Red Hat	Red Hat Single Sign-On 7	see references

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

https://access.redhat.com/security/cve/CVE-2026-24330 vdb-entry, x_refsource_REDHAT
RHBZ#2431939 issue-tracking, x_refsource_REDHAT