CVE-2026-111729

In Kura versions <= 5.6.2, the "Command" file-upload handler at `POST /admin/denali/file/command` extracts a client-supplied ZIP archive into the configured `command.working.directory`. The path-containment check `validateFileName()` compares canonical paths with `String.startsWith()` without appending a trailing path separator, so an entry that canonicalises to a sibling directory sharing the same string prefix (e.g. `/tmpevil/x` when the intended directory is `/tmp`) is accepted. The handler then calls `parent.mkdirs()` and `new FileOutputStream(newFile)`, creating directories and writing attacker-controlled bytes outside the intended extraction root. The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled. The caller must be authenticated with `rest.command` permission.

• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/428
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/958

• HIGHCVE-2012-20002PoC
• HIGHCVE-2014-125130PoC
• HIGHCVE-2014-125133PoC
• HIGHCVE-2014-125134PoC
• HIGHCVE-2015-20123PoC
• HIGHCVE-2015-20124PoC
• HIGHCVE-2015-20125PoC
• HIGHCVE-2016-20100PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.