---
id: "CVE-2026-97401"
page: "https://infrastack.ai/live/CVE-2026-97401"
kind: "vulnerability"
aliases: ["CVE-2026-97401"]
title: "Kura: REST command ZIP extraction lets unprivileged callers write arbitrary device files"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Kura", "fixed": [], "affected": "<= 5.6.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["eclipse-kura", "iot", "java", "kura", "other", "self-hosted"]
not_affected_if: ["command-service-disabled", "default-config"]
published_at: "2026-11-10T17:17:55+00:00"
first_seen_at: "2026-11-10T17:22:45+00:00"
updated_at: "2026-11-10T17:25:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97401", "first_seen_at": "2026-11-10T17:22:45+00:00"}, {"source": "analyst", "url": "https://eclipse-kura.github.io/kura/docs-develop/references/rest-apis/rest-command-api/", "first_seen_at": "2026-11-10T17:25:13+00:00", "cites": ["https://eclipse-kura.github.io/kura/docs-develop/references/rest-apis/rest-command-api/", "https://github.com/eclipse-kura/kura/releases"]}]
exploit_sources: []
---

# Kura: REST command ZIP extraction lets unprivileged callers write arbitrary device files

Link for people: https://infrastack.ai/live/CVE-2026-97401 (this .md is for agents)

Eclipse Kura, an IoT gateway framework, extracts a caller-supplied ZIP archive into a caller-supplied directory before running a command, inside a JVM that runs with CAP_DAC_OVERRIDE. An authenticated caller with the rest.command permission can write or overwrite arbitrary files on the device as the kurad user, bypassing the unprivileged executor the operator selected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kura affected <= 5.6.2 fixed no fixed version listed

## How to check

- Check the installed Kura version; <= 5.6.2 is in the affected range (5.6.3 released 2026-11-09 has archive extraction hardening, not yet tied to this CVE by the vendor).
- Look for the command service being enabled in the Kura configuration (privileged.command.service.enable). Default false since 4.0.0; the CVE text says the issue does not apply when the command service is disabled.
- List identities holding the rest.command permission; they can POST zipBytes plus workingDirectory to /services/command/v1/command/.

## Fix

Fixed version not confirmed by the vendor for this CVE. Affected is <= 5.6.2. Kura 5.6.3 (2026-11-09) release notes mention 'safer archive extraction' and unzip hardening but do not cite CVE-2026-97401; upgrading to 5.6.3 is the likely fix, confirm against the Eclipse advisory. Until then, keep privileged.command.service.enable=false and restrict rest.command.

## Timeline

- 2026-11-10T17:22:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97401
- 2026-11-10T17:25:13+00:00 analyst https://eclipse-kura.github.io/kura/docs-develop/references/rest-apis/rest-command-api/ — No vendor advisory or GitLab cve-assignment entry found for this CVE yet. Kura 5.6.3 (released 2026-11-09) release notes list 'Safer archive extraction' and a Command tab fix but do not name this CVE, so the fix is not confirmed. Nothing marked verified. Revisit when the Eclipse advisory appears.

## Documents

- [describes] Kura REST Command v1 API (zipBytes, workingDirectory) https://eclipse-kura.github.io/kura/docs-develop/references/rest-apis/rest-command-api/
- [mentions] Eclipse Kura 5.6.3 release notes (Nov 2026) https://github.com/eclipse-kura/kura/releases

## From the sources

In Kura versions <= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as `kurad` with `CAP_DAC_OVERRIDE`, while the configurable "Unprivileged" executor drops to the `kura` user via `su`.



A caller with permissions `rest.command` who is intentionally restricted to unprivileged command execution (`privileged.command.service.enable=false`, the default) can therefore set `workingDirectory` to `/` and use the ZIP body to write or overwrite arbitrary files on the device as `kurad`, completely bypassing the unprivileged sandbox the operator selected.



The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.



[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_