Skip to content
Fencer Vulns
medium 5.5

CVE-2018-10862 json

Improper Limitation of a Pathname to a Restricted Directory in WildFly

published 2018-07-27 8 y ago modified 2026-06-17 4 mo ago also GHSA-w8r2-5j8x-x8j6 , EUVD-2022-5534

cvss
5.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 69%
public exploits
0
none known

Summary

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

Patch / fix

  • maven org.wildfly.core:wildfly-server 6.0.0.Alpha3
  • eap7-guava jboss enterprise application platform 7.1 25.0.0-1.redhat_1.1.ep7.el7
  • eap7-jberet jboss enterprise application platform 7.1 1.2.6-2.Final_redhat_1.1.ep7.el7
  • eap7-wildfly jboss enterprise application platform 7.1 7.1.4-1.GA_redhat_1.1.ep7.el7
  • eap7-narayana jboss enterprise application platform 7.1 5.5.32-1.Final_redhat_1.1.ep7.el7
  • eap7-resteasy jboss enterprise application platform 7.1 3.0.26-1.Final_redhat_1.1.ep7.el7
  • eap7-undertow jboss enterprise application platform 7.1 1.4.18-7.SP8_redhat_1.1.ep7.el7
  • eap7-hibernate jboss enterprise application platform 7.1 5.1.15-1.Final_redhat_1.1.ep7.el7
  • eap7-ironjacamar jboss enterprise application platform 7.1 1.4.10-1.Final_redhat_1.1.ep7.el7

red hat advisories RHSA-2018:2424RHSA-2018:2423RHSA-2018:2643RHSA-2018:2276

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-10862 updated cvss 7.6

wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)

  • Red Hat JBoss Data Virtualization 6 wildfly wildfly
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes wildfly wildfly
    affected: no fix available
  • Red Hat Data Grid 7.3.6
    fixed: vendor fix RHSA-2020:2321
  • Red Hat JBoss EAP 7.1
    fixed: vendor fix RHSA-2018:2277
  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-guava 25.0.0-1.redhat_1.1.ep7.el6, eap7-wss4j 2.1.12-1.redhat_1.1.ep7.el6, eap7-wildfly 7.1.3-4.GA_redhat_3.1.ep7.el6, eap7-wildfly 7.1.4-1.GA_redhat_1.1.ep7.el6, eap7-apache-cxf 3.1.16-1.redhat_1.1.ep7.el6, eap7-jberet 1.2.6-2.Final_redhat_1.1.ep7.el6, +115 more
    fixed: vendor fix RHSA-2018:2423
  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-guava 25.0.0-1.redhat_1.1.ep7.el7, eap7-wss4j 2.1.12-1.redhat_1.1.ep7.el7, eap7-wildfly 7.1.3-4.GA_redhat_3.1.ep7.el7, eap7-wildfly 7.1.4-1.GA_redhat_1.1.ep7.el7, eap7-apache-cxf 3.1.16-1.redhat_1.1.ep7.el7, eap7-jberet 1.2.6-2.Final_redhat_1.1.ep7.el7, +115 more
    fixed: vendor fix RHSA-2018:2276
  • Red Hat JBoss Enterprise Application Platform Continuous Delivery
    fixed: vendor fix RHSA-2020:2562
  • Red Hat Single Sign-On 7.2
    fixed: vendor fix RHSA-2018:2279
show 4 more
  • Red Hat Single Sign-On 7.2.4 zip
    fixed: vendor fix RHSA-2018:2428
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance 4.2-20180828.0.el7 Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance 4.2-20180828.0.el7
    fixed: vendor fix RHSA-2018:2643
  • Red Hat Text-Only RHOAR
    fixed: vendor fix RHSA-2019:0877
  • Red Hat JBoss Developer Studio 11 wildfly wildfly Red Hat BPM Suite 6 wildfly wildfly Red Hat Fuse 7 wildfly wildfly Red Hat JBoss BRMS 6 wildfly wildfly Red Hat JBoss Data Grid 6 wildfly wildfly Red Hat JBoss Enterprise Application Platform 6 wildfly wildfly
    +2 more products
    Red Hat JBoss Fuse 6 wildfly wildfly Red Hat JBoss Operations Network 3 wildfly wildfly
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.26% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.9 AV:N/AC:M/Au:S/C:N/I:P/A:P
GitHub 3.0 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.wildfly.core:wildfly-server
<6.0.0.Alpha3
6.0.0.Alpha3

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.