A flaw was found in Apache Karaf. This vulnerability allows privilege escalation when the configuration service fails to properly restrict file paths to the designated configuration directory. An authenticated user with manager-level permissions can supply directory traversal sequences or absolute file paths to write attacker-controlled content to arbitrary files. Successful exploitation enables the attacker to grant themselves administrative privileges and achieve full container takeover.
Last checked: 2026-10-07 21:10 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-10-01 14:10 UTC)
Fix evidence last checked: 2026-10-02 16:54 UTC