---
id: "GHSA-7pm9-g8jh-3m74"
kind: "vulnerability"
aliases: ["GHSA-7pm9-g8jh-3m74"]
title: "Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "withdrawn"
category: "package"
products: [{"name": "org.keycloak:keycloak-services", "fixed": [], "affected": "< 26.6.4", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["cwe-22", "java", "keycloak", "package", "self-hosted"]
not_affected_if: ["manage-realm-restricted", "patched-version"]
published_at: "2026-06-25T18:30:41+00:00"
first_seen_at: "2026-10-29T16:39:02+00:00"
updated_at: "2026-10-29T16:39:57+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-7pm9-g8jh-3m74", "first_seen_at": "2026-10-29T16:39:02+00:00"}]
---

# Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

A realm administrator with the manage-realm role can submit an arbitrary filesystem path as a keystore parameter when creating a key provider component. The response reveals which files exist and are readable by the Keycloak process, which can help an attacker pick follow-on targets.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.keycloak:keycloak-services affected < 26.6.4 fixed ?

## How to check

- Check the Keycloak version with `kc.sh --version` or the admin console footer and compare against `26.6.4`

## Fix

- Keycloak `26.6.4` or later, per the affected range in the advisory metadata (this advisory was withdrawn as a duplicate of GHSA-9jrw-8xf7-xqhq, which the sources do not detail)

## Timeline

- 2026-10-29T16:39:02+00:00 ghsa https://github.com/advisories/GHSA-7pm9-g8jh-3m74

## From the sources

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9jrw-8xf7-xqhq. This link is maintained to preserve external references.

### Original Description
A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_