CVE-2026-102096: Kiteworks Core OS command injection
Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary operating-system commands, potentially with elevated privileges, on the affected appliance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Coreto a version that resolves this vulnerability.Fixed in 9.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Kiteworks Core administrator can exploit it by uploading a crafted configuration package. The provided data does not indicate that unauthenticated or lower-privileged users can trigger the issue.
Which systems are affected?
Kiteworks Core versions before 9.5.0 are affected. Systems running version 9.5.0 or later are not identified as affected by the provided information.
What access could successful exploitation provide?
A successful attacker could cause arbitrary operating-system commands to run on the affected appliance, potentially with elevated privileges. This could affect confidentiality, integrity, and availability.