The vulnerability lies in the ContentRepositoryImpl.copyExplodedContent function of the wildfly‑core library used by WildFly and JBoss EAP. An unsanitized deployment name allows an attacker who has the Deployer RBAC role to craft path traversal sequences. Because the function lacks a containment check, the attacker can read or modify files outside the intended deployment directory, which enables the deletion of arbitrary directories or the creation of files with arbitrary content. Consequently, the attacker can achieve a full privilege escalation to the management SuperUser role.

Affected products include Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7 and 8, the JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. Version information for the vulnerability is not listed in the CNA data, so any installation that utilizes the wildfly‑core library before the patch is considered vulnerable.

With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score is not available, so the likelihood of exploitation in the wild cannot be quantified, and the issue is not listed in the CISA KEV catalog. Exploitation requires that an attacker already possess the Deployer role, but once that role is acquired the path traversal can be used to compromise critical deployment files, leading to a full SuperUser elevation. Administrators should treat it as a high‑risk flaw pending a vendor patch.