CVE-2026-111729

In Kura versions <= 5.6.2, the "Command" file-upload handler at POST /admin/denali/file/command extracts a client-supplied ZIP archive into the configured command.working.directory. The path-containment check validateFileName() compares canonical paths with String.startsWith() without appending a trailing path separator, so an entry that canonicalises to a sibling directory sharing the same string prefix (e.g. /tmpevil/x when the intended directory is /tmp) is accepted. The handler then calls parent.mkdirs() and new FileOutputStream(newFile), creating directories and writing attacker-controlled bytes outside the intended extraction root.

The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled. The caller must be authenticated with rest.command permission.