CVE-2026-111729

In Kura versions = 5.6.2, the "Command" file-upload handler at POST /admin/denali/file/command extracts a client-supplied ZIP archive into the configured command.working.directory. The path-containment check validateFileName compares canonical paths with String.startsWith without appending a...

CVE-2026-97401

In Kura versions = 5.6.2, CommandCloudApp.execute extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as kurad with CAPDACOVERRIDE, while the...