{"id":"CVE-2026-97401","aliases":[],"cve":{"records":[{"id":"CVE-2026-97401","source":"eclipse","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-24T14:32:26.998Z","published":"2026-11-10T17:06:10.888Z","modified":"2026-11-10T17:06:10.888Z"}],"publishers":[{"name":"eclipse","role":"CNA","organizationId":"e51fbebd-6053-4e49-959f-1b94eeb69a2c","modified":"2026-11-10T17:06:10.888Z"}],"references":[{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/922","tags":[],"source":"eclipse"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/323","tags":[],"source":"eclipse"}],"weaknesses":[{"id":"CWE-73","description":"CWE-73","source":"eclipse"},{"id":"CWE-269","description":"CWE-269","source":"eclipse"}],"applicability":[],"prioritization":[]},"title":"In Kura versions <= 5.6.2, CommandCloudApp.execute() extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process…","titleSource":"eclipse","descriptionSource":"eclipse","description":"In Kura versions <= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as `kurad` with `CAP_DAC_OVERRIDE`, while the configurable \"Unprivileged\" executor drops to the `kura` user via `su`.\n\n\n\nA caller with permissions `rest.command` who is intentionally restricted to unprivileged command execution (`privileged.command.service.enable=false`, the default) can therefore set `workingDirectory` to `/` and use the ZIP body to write or overwrite arbitrary files on the device as `kurad`, completely bypassing the unprivileged sandbox the operator selected.\n\n\n\nThe command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.\n\n\n\n[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94","score":7.4,"severity":"high","published":"2026-11-10T17:06:10.888Z","modified":"2026-11-10T17:06:10.888Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Eclipse Foundation","name":"Eclipse Kura","platforms":[],"versions":[{"version":"0.7.0","status":"affected","lessThanOrEqual":"5.6.2","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"eclipse","url":"https://www.cve.org/CVERecord?id=CVE-2026-97401"}],"remediation":[],"references":["https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/922","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/323"],"sources":[{"name":"CVE","id":"CVE-2026-97401","modified":"2026-11-10T17:06:10.888Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-97401"}],"assessments":[{"source":"eclipse","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H","score":7.4}],"sourceAffected":[],"observedAt":"2026-11-10T17:21:10.364Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:10:33.488Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-10T17:25:34.435Z","attemptedAt":"2026-11-10T17:25:34.435Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T17:25:35.081Z","attemptedAt":"2026-11-10T17:25:35.081Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T17:25:35.646Z","attemptedAt":"2026-11-10T17:25:35.646Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T17:25:34.484Z","attemptedAt":"2026-11-10T17:25:34.484Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-97401","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97401","modified":"2026-11-10T17:17:55.450","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-10T17:25:34.435Z"}],"aiSummary":null}