GHSA-w8r2-5j8x-x8j6MediumCVSS 5.5

Improper Limitation of a Pathname to a Restricted Directory in WildFly

Published
May 14, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2018-10862 →

📋 Description

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

🎯 Affected products1

  • maven/org.wildfly.core:wildfly-server:<= 6.0.0.Alpha2

🔗 References (13)