In Kura versions <= 5.6.2, the "Command" file-upload handler at "POST /admin/denali/file/command" extracts a client-supplied ZIP archive into the configured "command.working.directory". The path-containment check "validateFileName()" compares canonical paths with "String.startsWith()" without appending a trailing path separator, so an entry that canonicalises to a sibling directory sharing the same string prefix (e.g. "/tmpevil/x" when the intended directory is "/tmp") is accepted. The handler then calls "parent.mkdirs()" and "new FileOutputStream(newFile)", creating directories and writing attacker-controlled bytes outside the intended extraction root. The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled. The caller must be authenticated with "rest.command" permission.