CVE-2026-91012
Apache Karaf: path traversal
- Risk score
- 74/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside ${karaf.etc}: if the submitted property map contains a f…
- Affected
- Apache Karaf
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Apache Karaf: Amber, patch this week. org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside ${karaf.etc}: if the submitted property map contains a f…
The flaws
- CVE-2026-91012: Path traversal (CVSS 9.8 · EPSS 1%)
- CVE-2026-91048: The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg (CVSS 9.8 · EPSS 1%)
- CVE-2026-91006: OS command injection (CVSS 8.8 · EPSS 1%)
- CVE-2026-92142: Missing authorisation can lead to remote code execution (CVSS 8.8 · EPSS 1%)
The fix
Upgrade Apache Karaf: 4.4.12 · 4.5.0 or later on your release line
Who is exposed: Apache Karaf
Where it stands
- No known exploitation
Connects to
- Same weakness: Path traversal (CWE-22). 399 other warnings in 30 days
- Same product: Earlier Apache Karaf warnings. 2 in the last 90 days
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside ${karaf.etc}: * if the submitted property map contains a felix.fileinstall.filename entry, that value is turned directly into a File (getCfgFileFromProperty), so it can point to any absolute path the Karaf process can write to; * otherwise the configuration PID is concatenated verbatim into the target file name (generateConfigFilename(): new File(karaf.etc, pid + ".cfg")), so a PID containing ".." segments resolves outside ${karaf.etc}. createFactoryConfiguration() has the same issue via the factory PID/alias. Both code paths are reachable by any caller holding the "manager" role under Karaf's shipped command/JMX ACL (org.apache.karaf.command.acl.conf.cfg: "update = manager"). Such a user can therefore write attacker-controlled content to any file the Karaf process can write, including files the same ACL otherwise reserves to "admin" (etc/users.properties, etc/*.acl.*.cfg, etc/org.apache.karaf.management.cfg, and similar), allowing a manager-role user to grant themselves the admin role or otherwise take over the container. ConfigMBeanImpl.install() and the config:install shell command already guarded the equivalent risk on their own code path with a finalname.contains("..") string check, but that check does not stop absolute paths or symlink-based escapes, and it was never applied to ConfigRepositoryImpl.update() / createFactoryConfiguration() at all.
Last activity 29 Sep 2026. Patch Forecast updates every hour.