{"id":"CVE-2026-111729","published":"2026-11-10T17:17:20.353","lastModified":"2026-11-10T17:17:20.353","description":"In Kura versions <= 5.6.2, the \"Command\" file-upload handler at `POST /admin/denali/file/command` extracts a client-supplied ZIP archive into the configured `command.working.directory`. The path-containment check `validateFileName()` compares canonical paths with `String.startsWith()` without appending a trailing path separator, so an entry that canonicalises to a sibling directory sharing the same string prefix (e.g. `/tmpevil/x` when the intended directory is `/tmp`) is accepted. The handler then calls `parent.mkdirs()` and `new FileOutputStream(newFile)`, creating directories and writing attacker-controlled bytes outside the intended extraction root.\n\n\n\nThe command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled. The caller must be authenticated with `rest.command` permission.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/428","tags":[]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/958","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}