{"id":"CVE-2026-111729","kind":"vulnerability","aliases":["CVE-2026-111729"],"related":[],"title":"Kura: ZIP upload path check lets files be written outside the extraction directory","description":"In Kura versions <= 5.6.2, the \"Command\" file-upload handler at `POST /admin/denali/file/command` extracts a client-supplied ZIP archive into the configured `command.working.directory`. The path-containment check `validateFileName()` compares canonical paths with `String.startsWith()` without appending a trailing path separator, so an entry that canonicalises to a sibling directory sharing the same string prefix (e.g. `/tmpevil/x` when the intended directory is `/tmp`) is accepted. The handler then calls `parent.mkdirs()` and `new FileOutputStream(newFile)`, creating directories and writing attacker-controlled bytes outside the intended extraction root.\n\n\n\nThe command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled. The caller must be authenticated with `rest.command` permission.","summary":"Kura's command file-upload handler extracts client-supplied ZIP archives, but its path check compares prefixes without a trailing separator, so a sibling directory with a matching prefix is accepted. An authenticated user with the command permission can create directories and write attacker-controlled files outside the intended extraction root.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Kura","fixed":[],"affected":"<= 5.6.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["java","kura","package","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed Kura version; <= 5.6.2 is the affected range (5.6.3, released 2026-11-09, has archive extraction hardening but is not tied to this CVE by the vendor).\n- Check whether the command service is enabled: it is disabled by default since 4.0.0; look for command.working.directory set in your configuration.\n- List identities holding the rest.command permission; only they can reach POST /admin/denali/file/command.","fix":"Fixed version not confirmed by the vendor for this CVE. Affected is <= 5.6.2. Kura 5.6.3 (2026-11-09) release notes mention 'safer archive extraction' but do not cite this CVE; upgrading to 5.6.3 is the likely fix, confirm against the Eclipse advisory. Until then keep the command service disabled and restrict the rest.command permission.","status":"open","published_at":"2026-11-10T17:17:20+00:00","first_seen_at":"2026-11-10T17:22:40+00:00","triaged_at":"2026-11-10T17:24:03+00:00","updated_at":"2026-11-10T17:27:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T17:24:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Kura: ZIP upload path check lets files be written outside the extraction directory","impact":"high","summary":"Kura's command file-upload handler extracts client-supplied ZIP archives, but its path check compares prefixes without a trailing separator, so a sibling directory with a matching prefix is accepted. An authenticated user with the command permission can create directories and write attacker-controlled files outside the intended extraction root.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kura","java","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker writes arbitrary files outside the extraction directory on the server","analyst_note":"Confirm the fixed version in the Kura release notes or GHSA entry; the sources give only '<= 5.6.2' and no fix.","how_to_check":"- Check the Kura version in use: versions `<= 5.6.2` are listed as affected.\n- Check whether the command service is enabled: it is disabled by default since `4.0.0`, so look for `command.working.directory` set in your configuration.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Only deployments where the Kura command service is enabled, which is off by default since 4.0.0. The attacker must hold the rest.command permission. Deployments with the command service disabled are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000751,"input_tokens":4753,"output_tokens":551,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version in the Kura release notes or GHSA entry; the sources give only '<= 5.6.2' and no fix.","search":"'-111729':16A,19A '-2026':15A,18A '/admin/denali/file/command':93C '/tmp':143C '/tmpevil/x':137C '1':178C '4.0.0':177C '5.6.2':84C 'accept':59B,145C 'append':117C 'appli':183C 'archiv':39B,100C 'attack':73B,160C 'attacker-control':72B,159C 'authent':61B,194C 'byte':162C 'call':149C 'caller':191C 'canon':112C 'canonicalis':126C 'check':5A,43B,109C 'client':36B,97C 'client-suppli':35B,96C 'command':29B,65B,86C,169C,186C 'command.working.directory':104C 'compar':44B,111C 'configur':103C 'contain':108C 'control':74B,161C 'creat':68B,155C 'cve':14A,17A 'default':174C 'directori':13A,53B,69B,130C,141C,156C 'disabl':172C,189C 'e.g':136C 'entri':124C 'extract':12A,34B,79B,94C,166C 'file':7A,31B,75B,88C 'file-upload':30B,87C 'fileoutputstream':153C 'handler':33B,90C,147C 'host':26B 'intend':78B,140C,165C 'issu':180C 'java':21B 'kura':1A,20A,22B,27B,82C,176C 'let':6A 'match':56B 'must':192C 'new':152C 'newfil':154C 'outsid':10A,76B,163C 'packag':23B 'parent.mkdirs':150C 'path':4A,42B,107C,113C,120C 'path-contain':106C 'permiss':66B,197C 'post':92C 'prefix':45B,57B,135C 'rest.command':196C 'root':80B,167C 'self':25B 'self-host':24B 'separ':49B,121C 'servic':170C,187C 'share':131C 'sibl':52B,129C 'sinc':175C 'string':134C 'string.startswith':115C 'suppli':37B,98C 'trail':48B,119C 'upload':3A,32B,89C 'user':62B 'validatefilenam':110C 'version':83C 'without':46B,116C 'write':71B,158C 'written':9A 'zip':2A,38B,99C","nicknames":[],"mitigations":[],"who_affected":"Only deployments where the Kura command service is enabled, which is off by default since 4.0.0. The attacker must hold the rest.command permission. Deployments with the command service disabled are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["kura"],"ptokens":["kura"],"labels":["high","java","kura","package","selfhosted"],"campaign_type":null,"search_a":"'-111729':16A,19A '-2026':15A,18A 'check':5A 'cve':14A,17A 'directori':13A 'extract':12A 'file':7A 'kura':1A,20A 'let':6A 'outsid':10A 'path':4A 'upload':3A 'written':9A 'zip':2A","search_b":"'accept':59B 'archiv':39B 'attack':73B 'attacker-control':72B 'authent':61B 'check':43B 'client':36B 'client-suppli':35B 'command':29B,65B 'compar':44B 'control':74B 'creat':68B 'directori':53B,69B 'extract':34B,79B 'file':31B,75B 'file-upload':30B 'handler':33B 'host':26B 'intend':78B 'java':21B 'kura':22B,27B 'match':56B 'outsid':76B 'packag':23B 'path':42B 'permiss':66B 'prefix':45B,57B 'root':80B 'self':25B 'self-host':24B 'separ':49B 'sibl':52B 'suppli':37B 'trail':48B 'upload':32B 'user':62B 'without':46B 'write':71B 'zip':38B","search_c":"'/admin/denali/file/command':93C '/tmp':143C '/tmpevil/x':137C '1':178C '4.0.0':177C '5.6.2':84C 'accept':145C 'append':117C 'appli':183C 'archiv':100C 'attack':160C 'attacker-control':159C 'authent':194C 'byte':162C 'call':149C 'caller':191C 'canon':112C 'canonicalis':126C 'check':109C 'client':97C 'client-suppli':96C 'command':86C,169C,186C 'command.working.directory':104C 'compar':111C 'configur':103C 'contain':108C 'control':161C 'creat':155C 'default':174C 'directori':130C,141C,156C 'disabl':172C,189C 'e.g':136C 'entri':124C 'extract':94C,166C 'file':88C 'file-upload':87C 'fileoutputstream':153C 'handler':90C,147C 'intend':140C,165C 'issu':180C 'kura':82C,176C 'must':192C 'new':152C 'newfil':154C 'outsid':163C 'parent.mkdirs':150C 'path':107C,113C,120C 'path-contain':106C 'permiss':197C 'post':92C 'prefix':135C 'rest.command':196C 'root':167C 'separ':121C 'servic':170C,187C 'share':131C 'sibl':129C 'sinc':175C 'string':134C 'string.startswith':115C 'suppli':98C 'trail':119C 'upload':89C 'validatefilenam':110C 'version':83C 'without':116C 'write':158C 'zip':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111729","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111729","severity":null,"published_at":"2026-11-10T17:17:20+00:00","modified_at":"2026-11-10T17:17:20+00:00","first_seen_at":"2026-11-10T17:22:40+00:00","fetched_at":"2026-11-10T17:22:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111729:2482","url":"https://github.com/eclipse-kura/kura/releases","severity":null,"published_at":"2026-11-10T17:27:27+00:00","modified_at":"2026-11-10T17:27:27+00:00","first_seen_at":"2026-11-10T17:27:27+00:00","fetched_at":"2026-11-10T17:27:27+00:00","note":"No Eclipse/GHSA advisory naming this CVE found; only NVD text plus 5.6.3 release notes (safer archive extraction, not CVE-tied). Fix left unconfirmed, nothing verified. Sibling CVE-2026-97401 same situation. Revisit when advisory appears.","cites":["https://github.com/eclipse-kura/kura/releases"]}],"documents":[{"id":115752,"url":"https://github.com/eclipse-kura/kura/releases","title":"Eclipse Kura 5.6.3 release notes (Nov 2026)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}