CVE-2026-102133
Kiteworks Core Arbitrary File Write through Command Injection
- State
- Published
- Severity
- 6.6 Medium
- Published
- Sep 30, 2026
- Updated
- Oct 1, 2026
- Reserved
- Sep 28, 2026
Description
An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.6 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H | cisa-cg |
Weaknesses
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected Products
| Product | Versions |
|---|---|
CoreKiteworks |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.