CVE-2014-7816: Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x...

Security readout for executives and security teams

CVE-2014-7816 is a legacy JBoss Undertow directory traversal flaw on Windows. A remote user could read files outside the intended web resource path if an affected Undertow version handled a crafted resource URI. The public bundle does not show active exploitation or a CVSS score. Exposure is most likely in old Java application stacks using Undertow directly, or products bundling affected Undertow releases, running on Windows. Non-Windows deployments are not identified as affected in the provided sources. Prioritize remediation if affected Undertow versions are internet-facing or handle sensitive files on Windows. For internal-only legacy systems, schedule upgrade through normal vulnerability management, but verify exposure because arbitrary file read can reveal credentials or configuration secrets. Mitigation focus: Upgrade Undertow to 1.0.17, 1.1.0.CR5, 1.2.0.Beta3, or later as applicable.; Check vendor guidance for bundled Undertow in JBoss or WildFly products.; Prioritize affected Windows-hosted services reachable from untrusted networks..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.