Threats tagged 'ghsa-g8qh-9p3h-fvrm'

Kura versions up to 5.6.2 contain a directory traversal vulnerability in the "Command" file-upload handler at POST /admin/denali/file/command. The handler extracts a client-supplied ZIP archive into a configured directory but performs an insufficient path containment check, allowing crafted archive entries to write files outside the intended extraction directory. This can lead to attacker-controlled file creation in arbitrary locations. The command service is disabled by default since version 4.0.0, and the vulnerability only applies if the service is enabled and the caller is authenticated with rest.command permission.