Quick answers
- Is CVE-2026-111729 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-111729 being exploited in the wild.
- How severe is CVE-2026-111729?
- Informational severity, published 10 November 2026.
- Which products and versions are affected?
- Eclipse Kura 0.7.0 through 5.6.2.
- Is there a fix for CVE-2026-111729?
- No fixed version is recorded yet. Disable the command service if not required (it is disabled by default since Kura 4.0.0). Restrict the command.working.directory to a location without security-sensitive sibling-prefix paths, and ensure the Kura process does not run with root privileges. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-111729 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-111729?
- Check whether you run Eclipse Kura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Disable the command service if not required (it is disabled by default since Kura 4.0.0). Restrict the command.working.directory to a location without security-sensitive sibling-prefix paths, and ensure the Kura process does not run with root privileges.
Technical details
The vulnerability is a partial zip-slip (CWE-22) in the `validateFileName()` method of FileServlet. The path-containment check uses String.startsWith() without appending a trailing path separator, allowing an attacker to create ZIP entries with names like `/tmpevil/x` when the intended working directory is `/tmp`. The code then calls parent.mkdirs() and FileOutputStream with attacker-controlled paths, enabling directory creation and file writes outside the intended root. Exploitation requires an authenticated session with rest.command permission; the command service is disabled by default since Kura 4.0.0.
Affected products
- Eclipse Kura 0.7.0 through 5.6.2
Timeline
- 2026-11-10: disclosed