https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 06:11:09 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-97401 <p>In Kura versions &lt;= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as `kurad` with `CAP_DAC_OVERRIDE`, while the configurable &#34;Unprivileged&#34; executor drops to the `kura` user via `su`.</p> <p>A caller with permissions `rest.command` who is intentionally restricted to unprivileged command execution (`privileged.command.service.enable=false`, the default) can therefore set `workingDirectory` to `/` and use the ZIP body to write or overwrite arbitrary files on the device as `kurad`, completely bypassing the unprivileged sandbox the operator selected.</p> <p>The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.</p> <p>[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94</p> <p>In Kura versions &lt;= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as `kurad` with `CAP_DAC_OVERRIDE`, while the configurable &#34;Unprivileged&#34; executor drops to the `kura` user via `su`.</p> <p>A caller with permissions `rest.command` who is intentionally restricted to unprivileged command execution (`privileged.command.service.enable=false`, the default) can therefore set `workingDirectory` to `/` and use the ZIP body to write or overwrite arbitrary files on the device as `kurad`, completely bypassing the unprivileged sandbox the operator selected.</p> <p>The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.</p> <p>[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94</p> https://db.gcve.eu/vuln/fkie_cve-2026-97401 https://db.gcve.eu/vuln/ghsa-wqp3-6ff6-46w7 <p>In Kura versions &lt;= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as `kurad` with `CAP_DAC_OVERRIDE`, while the configurable &#34;Unprivileged&#34; executor drops to the `kura` user via `su`.</p> <p>A caller with permissions `rest.command` who is intentionally restricted to unprivileged command execution (`privileged.command.service.enable=false`, the default) can therefore set `workingDirectory` to `/` and use the ZIP body to write or overwrite arbitrary files on the device as `kurad`, completely bypassing the unprivileged sandbox the operator selected.</p> <p>The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.</p> <p>[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94</p> <p>In Kura versions &lt;= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as `kurad` with `CAP_DAC_OVERRIDE`, while the configurable &#34;Unprivileged&#34; executor drops to the `kura` user via `su`.</p> <p>A caller with permissions `rest.command` who is intentionally restricted to unprivileged command execution (`privileged.command.service.enable=false`, the default) can therefore set `workingDirectory` to `/` and use the ZIP body to write or overwrite arbitrary files on the device as `kurad`, completely bypassing the unprivileged sandbox the operator selected.</p> <p>The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.</p> <p>[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94</p> https://db.gcve.eu/vuln/ghsa-wqp3-6ff6-46w7