Red Hat JBoss Enterprise Application Platform 8, based on the WildFly runtime, contains a Cross-Site Scripting vulnerability in the io.undertow.jastow-jastow module caused by unsanitized URI input (CVE-2025-12799). This vulnerability allows injection of malicious scripts via crafted URIs. Red Hat released version 8.1.7 of the platform to fix this issue by upgrading the Jastow component from 2.2.9.Final-redhat-00001 to 2.2.9.SP1-redhat-00001, along with other component updates. The advisory rates the security impact as Important (medium severity) and recommends applying the update after ensuring all prior errata are applied and backing up existing installations.

The vulnerability enables Cross-Site Scripting attacks due to unsanitized URI input in the Jastow component, potentially allowing attackers to execute arbitrary scripts in the context of affected applications. This can lead to client-side code execution impacting users of applications running on the affected platform. The advisory does not report known exploits in the wild.

A security update is available in Red Hat JBoss Enterprise Application Platform version 8.1.7, which fixes the vulnerability by upgrading the Jastow component. Users should apply this update after ensuring all previously released errata are applied and backing up their systems and configurations. Follow Red Hat's official guidance for applying updates as detailed in their documentation. No additional mitigation steps are indicated by the vendor.