Eclipse Kura EUVD-2026-121412

Exploitation requires three concrete prerequisites: (1) the optional Kura Command service must be explicitly enabled, as it is disabled by default since Kura 4.0.0 and the issue does not apply when disabled; (2) the attacker must be authenticated with the rest.command permission (PR:L); and (3) the attacker must supply a ZIP archive containing an entry whose canonical path shares the same string prefix as the configured command.working.directory (e.g. /tmpevil/x when the root is /tmp) to defeat the validateFileName() startsWith containment check. Limiting factors that reduce real-world risk: the non-default configuration requirement, the authenticated-with-specific-permission gate, and affected versions being <= 5.6.2. No user interaction is required (UI:N).

This is a moderate, conditional-risk path traversal (CWE-22) rather than a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) and the 7.0 base score describe network-reachable, low-complexity exploitation but require privileges (PR:L) - consistent with the description's statement that the caller must be authenticated with the rest.command permission. Impact is limited to integrity (VI:H/SI:H) with no confidentiality or availability impact (VC:N/VA:N), matching an arbitrary-file-write primitive. Critically, the AT:P (attack requirements present) metric aligns with the fact that the Command service is disabled by default since Kura 4.0.0, so a default deployment is not exploitable. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input; the two references are Eclipse GitLab vulnerability-tracking work items, not verified working exploit code. The vuln.today decision label is 'this_week' (not act_now/emergency), which fits a flaw gated behind both authentication and a non-default configuration. Net: a genuine authenticated file-write/traversal bug worth patching on a normal priority cycle, not a high-CVSS-but-widely-weaponized internet threat. One signal to verify: the input lists no fixed version, so remediation timing should be confirmed with the Eclipse advisory.

An authenticated operator (or an attacker who has obtained an account holding the rest.command permission) on a Kura instance where the optional Command service has been enabled uploads a crafted ZIP to POST /admin/denali/file/command. One archive entry canonicalises to a sibling directory sharing the same string prefix as the configured command.working.directory (e.g. /tmpevil/x vs /tmp), slipping past the flawed validateFileName() startsWith check so the handler writes attacker-controlled bytes outside the intended extraction root. No public exploit was identified at time of analysis; the trigger mechanism itself is fully described in the advisory text.