CVE-2026-111729

In Kura versions <= 5.6.2, the "Command" file-upload handler at `POST /admin/denali/file/command` extracts a client-supplied ZIP archive into the configured…

In Kura versions <= 5.6.2, the "Command" file-upload handler at `POST /admin/denali/file/command` extracts a client-supplied ZIP archive into the configured `command.working.directory`. The path-containment check `validateFileName()` compares canonical paths with `String.startsWith()` without appending a trailing path separator, so an entry that canonicalises to a sibling directory sharing the same string prefix (e.g. `/tmpevil/x` when the intended directory is `/tmp`) is…

10. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-111729