CVE-2026-85634: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Fuse 7

The vulnerability in Red Hat Fuse 7 arises from improper limitation of a pathname in the ContentRepositoryImpl.copyExplodedContent function within the wildfly-core library. Due to a missing containment check when processing deployment names, an attacker with the Deployer RBAC role can use path traversal sequences to escape the restricted deployment directory. This enables deletion or creation of arbitrary files, which can escalate privileges to the management SuperUser role. The issue affects deployments managed by WildFly and JBoss EAP components integrated into Red Hat Fuse 7. The CVSS 3.1 score is 8.8, indicating a high impact on confidentiality, integrity, and availability.

An attacker with the Deployer RBAC role can exploit this vulnerability to perform path traversal attacks, allowing them to delete arbitrary directories or create files with arbitrary content outside the intended deployment directory. This leads to full privilege escalation to the management SuperUser role, compromising the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-85634 for current remediation guidance. Until an official fix is available, restrict Deployer RBAC role assignments to trusted users only and monitor deployment activities closely to detect any suspicious behavior related to deployment names.