{"cve":"CVE-2026-17614","nvd":{"published":"2026-08-04T03:16:25.537","modified":"2026-08-06T15:37:22.093","status":"Awaiting Analysis","description":"A path traversal flaw was found in WildFly's domain mode\n  implementation. The LocalFileRepository.getFile() and\n  getConfigurationFile() methods in\n  wildfly-core/deployment-repository do not validate that the\n  resolved file path remains within the configured repository or\n  configuration root directories. A remote attacker who has\n  obtained the slave host controller secret or compromised a slave\n  host controller can supply a crafted relative path containing\n  directory traversal sequences (e.g., ../../etc/passwd) via the\n  slave-DC wire protocol, causing the Domain Controller to resolve\n  and serve arbitrary files readable by the DC process. This leads\n  to unauthorized disclosure of sensitive information such as\n  configuration files, keystores, and system credentials.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","score":4.4},"cwes":["CWE-22"],"references":["https://access.redhat.com/security/cve/CVE-2026-17614","https://bugzilla.redhat.com/show_bug.cgi?id=2507631"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:47:10.050265369+00:00"},"epss":{"cve":"CVE-2026-17614","score":0.0113,"percentile":0.66424,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}