{"id":"CVE-2026-97401","published":"2026-11-10T17:17:55.450","lastModified":"2026-11-10T17:17:55.450","description":"In Kura versions <= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as `kurad` with `CAP_DAC_OVERRIDE`, while the configurable \"Unprivileged\" executor drops to the `kura` user via `su`.\n\n\n\nA caller with permissions `rest.command` who is intentionally restricted to unprivileged command execution (`privileged.command.service.enable=false`, the default) can therefore set `workingDirectory` to `/` and use the ZIP body to write or overwrite arbitrary files on the device as `kurad`, completely bypassing the unprivileged sandbox the operator selected.\n\n\n\nThe command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.\n\n\n\n[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-73","CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/323","tags":[]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/922","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}