A path traversal vulnerability exists in the LocalFileRepository.getFile() and getConfigurationFile() methods of wildfly-core/deployment-repository used by WildFly in domain mode. These methods fail to validate that resolved file paths remain within configured repository or configuration root directories. An attacker who has obtained the slave host controller secret or compromised a slave host controller can send crafted relative paths containing directory traversal sequences (e.g., ../../etc/passwd) via the slave-DC wire protocol. This causes the Domain Controller to resolve and serve arbitrary files readable by the Domain Controller process, leading to unauthorized disclosure of sensitive data such as configuration files, keystores, and system credentials. The vulnerability has a CVSS 3.1 base score of 4.4 (medium severity) with network attack vector, high attack complexity, and high privileges required. Red Hat's advisory states that no mitigation or fix meeting their criteria is currently available.

An attacker with access to the slave host controller secret or control over a slave host controller can read arbitrary files on the Domain Controller's filesystem. This unauthorized file disclosure can expose sensitive information including configuration files, keystores, and system credentials. The vulnerability does not impact integrity or availability but poses a confidentiality risk. The attack requires high privileges and network access, limiting the attack surface to authenticated or compromised slave host controllers.

Red Hat's advisory states that no mitigation or fix meeting their criteria for ease of use, deployment, applicability, or stability is currently available. Users should monitor the Red Hat advisory for updates on remediation. Until a fix or mitigation is provided, restricting access to slave host controller secrets and ensuring the security of slave host controllers is critical to reduce risk.