# CVE-2026-111729: Eclipse Kura path traversal in command file-upload handler

Source: https://junglewise.ai/threats/cve-2026-111729-in-kura-versions-5-6-2-the-command-file-upload-handler-at-post  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-111729 · Severity: info · Published 2026-11-10

Eclipse Kura is an IoT gateway management platform that allows administrators to upload command files through a web console. The file-upload handler contains a path-validation bug that allows an authenticated user with command permissions to write files outside the intended directory, potentially writing to sensitive filesystem locations if the Kura process runs with elevated privileges.

Technologies: [Eclipse Kura](https://junglewise.ai/threats/technologies/eclipse-kura). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-111729 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111729 being exploited in the wild.

**How severe is CVE-2026-111729?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Eclipse Kura 0.7.0 through 5.6.2.

**Is there a fix for CVE-2026-111729?** No fixed version is recorded yet. Disable the command service if not required (it is disabled by default since Kura 4.0.0). Restrict the command.working.directory to a location without security-sensitive sibling-prefix paths, and ensure the Kura process does not run with root privileges. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111729 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-111729?** Check whether you run Eclipse Kura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable the command service if not required (it is disabled by default since Kura 4.0.0). Restrict the command.working.directory to a location without security-sensitive sibling-prefix paths, and ensure the Kura process does not run with root privileges.

## Technical details

The vulnerability is a partial zip-slip (CWE-22) in the `validateFileName()` method of FileServlet. The path-containment check uses String.startsWith() without appending a trailing path separator, allowing an attacker to create ZIP entries with names like `/tmpevil/x` when the intended working directory is `/tmp`. The code then calls parent.mkdirs() and FileOutputStream with attacker-controlled paths, enabling directory creation and file writes outside the intended root. Exploitation requires an authenticated session with rest.command permission; the command service is disabled by default since Kura 4.0.0.

## Affected products

- Eclipse Kura 0.7.0 through 5.6.2

## Timeline

- 2026-11-10: disclosed

## References

- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/428](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/428)
- [https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/958](https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/958)

## Related threats

- [Eclipse Kura Web Console session exhaustion denial of service](https://junglewise.ai/threats/cve-2026-97891-in-eclipse-kura-version-5-0-0-to-5-6-2-the-web-console-allocates)
- [Eclipse Kura privilege escalation in CommandCloudApp ZIP extraction](https://junglewise.ai/threats/cve-2026-97401-in-kura-versions-5-6-2-commandcloudapp-execute-extracts-a-caller)
- [Eclipse Kura Service Listing V1 unauthenticated denial of service](https://junglewise.ai/threats/cve-2026-112186-in-eclipse-kura-versions-5-4-0-through-5-6-2-the-service-listing)
- [Eclipse Kura Configuration REST API authorization bypass](https://junglewise.ai/threats/cve-2026-112185-in-eclipse-kura-versions-5-1-0-through-5-6-2-the-configuration)
- [Eclipse Kura BLE advertisement decoder infinite loop](https://junglewise.ai/threats/cve-2026-97402-in-eclipse-kura-versions-3-1-0-to-5-6-2-the-ibeacon-and-eddystone)