CVE-2026-111729

In Kura versions = 5.6.2, the "Command" file-upload handler at POST /admin/denali/file/command extracts a client-supplied ZIP archive into the configured command.working.directory. The path-containment check validateFileName compares canonical paths with String.startsWith without appending a...