Medium
Security advisory
A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-1047
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:18 UTC · Revision 1
Source evidence
A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.
osv:CVE-2018-1047
Complete source record
{
"id": "c8d351d7a9c664f2b45c0a19cf02d5a8353a8bb42e9430df43f1e12ff7d1cf58",
"url": "https://osv.dev/vulnerability/CVE-2018-1047",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-1047",
"summary": "A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.",
"evidence": "osv:CVE-2018-1047",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2018-1047",
"aliases": [
"CVE-2018-1047",
"GHSA-fmr4-w67p-vh8x"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/wildfly/wildfly",
"type": "GIT",
"events": [
{
"introduced": "bb382e0b0c80920ae33d9ef4bb568a28cc7e8477"
},
{
"last_affected": "95fa2360ea2f698378c730d40eb3ee3812f271a9"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0"
},
{
"last_affected": "9.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:beta1:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-beta1"
},
{
"last_affected": "9.0.0-beta1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:beta2:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-beta2"
},
{
"last_affected": "9.0.0-beta2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:cr1:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-cr1"
},
{
"last_affected": "9.0.0-cr1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:cr2:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-cr2"
},
{
"last_affected": "9.0.0-cr2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.1"
},
{
"last_affected": "9.0.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.2"
},
{
"last_affected": "9.0.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0"
},
{
"last_affected": "10.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:alpha1:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-alpha1"
},
{
"last_affected": "10.0.0-alpha1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:alpha2:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-alpha2"
},
{
"last_affected": "10.0.0-alpha2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:alpha3:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-alpha3"
},
{
"last_affected": "10.0.0-alpha3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:alpha4:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-alpha4"
},
{
"last_affected": "10.0.0-alpha4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:alpha5:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-alpha5"
},
{
"last_affected": "10.0.0-alpha5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:alpha6:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-alpha6"
},
{
"last_affected": "10.0.0-alpha6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:beta1:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-beta1"
},
{
"last_affected": "10.0.0-beta1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:beta2:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-beta2"
},
{
"last_affected": "10.0.0-beta2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:cr1:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-cr1"
},
{
"last_affected": "10.0.0-cr1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:cr2:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-cr2"
},
{
"last_affected": "10.0.0-cr2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:cr3:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-cr3"
},
{
"last_affected": "10.0.0-cr3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:cr4:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-cr4"
},
{
"last_affected": "10.0.0-cr4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:cr5:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0-cr5"
},
{
"last_affected": "10.0.0-cr5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.1.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.1.0"
},
{
"last_affected": "10.1.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:10.1.0:cr1:*:*:*:*:*:*",
"range": [
{
"introduced": "10.1.0-cr1"
},
{
"last_affected": "10.1.0-cr1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:11.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0"
},
{
"last_affected": "11.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:11.0.0:alpha1:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-alpha1"
},
{
"last_affected": "11.0.0-alpha1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:11.0.0:beta1:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-beta1"
},
{
"last_affected": "11.0.0-beta1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:jboss_wildfly_application_server:11.0.0:cr1:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-cr1"
},
{
"last_affected": "11.0.0-cr1"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"10.0.0",
"10.0.0-alpha1",
"10.0.0-alpha2",
"10.0.0-alpha3",
"10.0.0-alpha4",
"10.0.0-alpha5",
"10.0.0-alpha6",
"10.0.0-beta1",
"10.0.0-beta2",
"10.0.0-cr1",
"10.0.0-cr2",
"10.0.0-cr3",
"10.0.0-cr4",
"10.0.0-cr5",
"10.1.0",
"10.1.0-cr1",
"11.0.0",
"11.0.0-alpha1",
"11.0.0-beta1",
"11.0.0-cr1",
"9.0.0",
"9.0.0-beta1",
"9.0.0-beta2",
"9.0.0-cr1",
"9.0.0-cr2",
"9.0.1",
"9.0.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1047.json"
}
}
],
"modified": "2026-10-24T10:30:37.663815329Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2018:1247",
"https://access.redhat.com/errata/RHSA-2018:1248",
"https://access.redhat.com/errata/RHSA-2018:1249",
"https://access.redhat.com/errata/RHSA-2018:1251",
"https://access.redhat.com/errata/RHSA-2018:2938",
"https://bugzilla.redhat.com/show_bug.cgi?id=1528361",
"https://issues.jboss.org/browse/WFLY-9620"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:jboss_enterprise_application_platform",
"extracted_events": [
{
"range": [
{
"introduced": "7.1.0"
},
{
"last_affected": "7.1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:alpha1:*:*:*:*:*:*"
],
"vendor_product": "redhat:jboss_wildfly_application_server",
"extracted_events": [
{
"range": [
{
"introduced": "9.0.0-alpha1"
},
{
"last_affected": "9.0.0-alpha1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-1047",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 434276,
"published_at": "2018-01-24T23:29:00.527+00:00"
}