[kali834x]

MultipartFormDataBuilder and AdminActions.doUpload now give their commons-fileupload2 DiskFileItemFactory the servlet context's private temp directory (ServletContext.TEMPDIR), which is also where the container's own multipart parsing spills. both built the factory with no location, so fileupload2 2.0.0-M5 wrote any part over its 10 KB threshold to java.io.tmpdir/upload__.tmp through a plain Files.newOutputStream, leaving the mode to the umask: with the usual 022 the upload is rw-r--r-- in a directory every local account can list. the builder is registered for multipart/form-data in the shipped axis2.xml files and the spring boot starter's soap config, AxisServlet hands it any anonymous multipart POST to a /services/ url through RESTUtil.processXMLRequest, and a file part stays on disk until the item behind the service's DataHandler is collected; for a spring boot deployment java.io.tmpdir is the shared /tmp (CWE-377/CWE-732, the class of netty CVE-2021-21290). the admin console upload built the same factory, and an aar can carry services.xml credentials or a keystore. where a container does not publish TEMPDIR the library default is kept. MultipartFormDataBuilderTest gains a case that fails on master (the part lands in java.io.tmpdir) and passes with the change, and a standalone run under umask 022 showed the part written rw-r--r-- into the shared temp dir before and into the rwx------ context temp dir after. kernel (499 tests), transport-http (114) and webapp verify with -Papache-release, kernel and webapp also build on release 21 and 25, and the webapp integration tests (13, including the admin upload and redeploy) pass.