The vulnerability in Apache Karaf arises from the ConfigRepositoryImpl.update(pid, properties) method, which writes configuration files based on caller-supplied input without properly validating that the resulting file path remains within the designated ${karaf.etc} directory. If the property map contains a felix.fileinstall.filename entry, it is directly converted to a File object, allowing absolute paths. Otherwise, the PID is concatenated verbatim, permitting directory traversal via '..' segments. Both code paths are accessible to users with the 'manager' role, enabling them to write arbitrary files, including those reserved for 'admin' users, such as etc/users.properties and ACL configuration files. This can lead to privilege escalation or container takeover. Previous protections on similar code paths do not apply here, and checks against '..' segments or symlink escapes are missing. The affected versions are Apache Karaf >=0 and <4.4.12.

An attacker with 'manager' role privileges can exploit this vulnerability to write arbitrary files anywhere writable by the Karaf process. This includes sensitive configuration files that control user roles and access control, allowing the attacker to escalate privileges to 'admin' or fully compromise the container. This undermines the security model of Apache Karaf and can lead to complete system takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict 'manager' role assignments to trusted users only and monitor for suspicious activity. Avoid exposing management interfaces to untrusted networks. Review and harden ACL configurations to limit potential abuse.