The flaw resides in Undertow's PathResourceManager, which serves static files from the file system. The safe path check uses only a prefix string comparison to validate a symbolic link target. If a link points to a sibling directory whose name starts with the same characters as an allowed safe directory, the check passes, granting read access to files outside the intended directory. This is a directory traversal vulnerability, classified as CWE‑22, that permits an attacker to read arbitrary files for which they have no legitimate access.

Affected products include Red Hat Enterprise Linux 8 and 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7 and 8 as well as its Expansion Pack, Red Hat Single Sign‑On 7, and the Red Hat build of Apache Camel for Spring Boot 4. These releases incorporate the underlying Undertow server component that contains the unsafe path check.

The CVSS score of 3.7 places the vulnerability in the Low severity range, and it is not listed in the CISA KEV catalog. With no EPSS value available, the potential for widespread exploitation appears limited. The likely attack vector is a crafted web request that includes a symbolic link designed to bypass the path check, allowing a remote attacker with access to the web server to read protected files.