CVE-2026-24330CWE-434unrestricted-file-upload

CVE-2026-24330

Medium · published August 11, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00517 · 43.1th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-08-11T07:17Z
References (2)
https://access.redhat.com/security/cve/CVE-2026-24330 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2431939 · [email protected]
EPSS history
Timeline
  • 11 AUG 02:35Z
    Wildfly-core: wildfly: arbitrary file read via malicious archive deployment
    cvelistv5