CVE-2026-97401

In Kura versions <= 5.6.2, CommandCloudApp.execute() extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as kurad with CAP_DAC_OVERRIDE, while the configurable "Unprivileged" executor drops to the kura user via su.

A caller with permissions rest.command who is intentionally restricted to unprivileged command execution (privileged.command.service.enable=false, the default) can therefore set workingDirectory to / and use the ZIP body to write or overwrite arbitrary files on the device as kurad, completely bypassing the unprivileged sandbox the operator selected.

The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.

[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94