CVE-2026-91012: Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation

Apache Karaf's configuration repository writes config files from caller-supplied input without keeping the result inside ${karaf.etc}. A principal who already has the shipped manager role can reach ConfigRepositoryImpl.update or createFactoryConfiguration through the config MBean or config shell commands and cause the process to write attacker-controlled content to any path it can write, including files otherwise reserved for admin such as etc/users.properties, ACL configs, and management configuration. That write can be used to grant admin or otherwise take over the container. An older ".." check on the install path was incomplete and was never applied to these update and factory-create paths. No public proof of concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored.