CVE-2026-97401

In Kura versions = 5.6.2, CommandCloudApp.execute extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as kurad with CAPDACOVERRIDE, while the...