CVE-2018-1047: Improper Input Validation in org.wildfly:wildfly-undertow
Summary
CVE-2018-1047: Improper Input Validation in org.wildfly:wildfly-undertow. Affects org.wildfly:wildfly-undertow versions < 12.0.0. Fixed in 12.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The org.wildfly:wildfly-undertow package is a part of the Wildfly application server. It provides the Undertow web server implementation, which is used for handling HTTP requests and serving web applications. The package is commonly used in Java-based web applications and provides various features for managing web resources. However, a vulnerability has been discovered in Wildfly 9.x that allows for path traversal attacks through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method. This vulnerability can lead to the disclosure of arbitrary local files, potentially exposing sensitive information to attackers.
Vulnerability Detail
The vulnerability in org.wildfly:wildfly-undertow arises due to improper input validation in the ServletResourceManager.getResource method. By exploiting this flaw, an attacker can manipulate the input to traverse the file system and access arbitrary local files. This can result in the disclosure of sensitive information, such as configuration files, credentials, or other confidential data stored on the server. The impact of this vulnerability depends on the nature of the exposed files and the privileges of the user running the Wildfly server. It is important to note that this vulnerability only affects Wildfly 9.x versions.
How To Fix
Latest published version: 42.0.0.Final as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
12.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented to mitigate the risk. One possible workaround is to restrict access to the vulnerable ServletResourceManager.getResource method by configuring appropriate access controls or filters. By limiting access to this method, the potential for path traversal attacks can be reduced. However, this workaround may not provide complete protection and should only be considered as a temporary measure until the server can be upgraded to a fixed version.
Conclusion
The vulnerability in org.wildfly:wildfly-undertow can lead to the disclosure of arbitrary local files through path traversal attacks. To mitigate this risk, it is crucial to upgrade to a fixed version of Wildfly, specifically version 12.0.0 or later. If immediate upgrading is not possible, implementing access controls or filters to restrict access to the vulnerable method can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.wildfly:wildfly-undertow →
FAQ
The vulnerability allows for path traversal attacks, potentially leading to the disclosure of arbitrary local files. The impact depends on the nature of the exposed files and the privileges of the user running the Wildfly server.
This vulnerability affects Wildfly 9.x versions. Later versions, starting from 12.0.0, have been patched and are not vulnerable.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Wildfly, specifically version 12.0.0 or later.
If upgrading to a fixed version is not immediately feasible, access to the vulnerable ServletResourceManager.getResource method can be restricted through access controls or filters as a temporary workaround.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to promptly apply the recommended fixes to prevent potential attacks.
Related vulnerabilities
Recent vulnerabilities recorded for org.wildfly:wildfly-undertow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
