CVE WatchNov 10, 2026

CVE-2026-97401

In Kura versions <= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Ku

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0-100

Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-73 · CWE-269

EPSS · 30d

Not enough EPSS history yet.

Technical description

In Kura versions <= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as `kurad` with `CAP_DAC_OVERRIDE`, while the configurable "Unprivileged" executor drops to the `kura` user via `su`. A caller with permissions `rest.command` who is intentionally restricted to unprivileged command execution (`privileged.command.service.enable=false`, the default) can therefore set `workingDirectory` to `/` and use the ZIP body to write or overwrite arbitrary files on the device as `kurad`, completely bypassing the unprivileged sandbox the operator selected. The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled. [1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1229867.8 HIG

—

——0Improper privilege management in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges locally.4h CVE-2026-1199766.5 MED

—

——0External control of file name or path in Visual Studio Code - GitHub Pull Requests and Issues Extension allows an unauthorized attacker to disclose information over a network.4h CVE-2026-1199397.8 HIG

—

——0Improper privilege management in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.4h CVE-2026-1181517.2 HIG

—

——0External control of file name or path in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.3h CVE-2026-1055315.5 MED

—

——0External control of file name or path in Windows Print Spooler Components allows an authorized attacker to disclose information locally.4h CVE-2026-61468—

—

——0Improper privilege management in the MigTD logging for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.5h