CVE-2026-102133: Kiteworks Core Arbitrary File Write through Command Injection
An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Exposure is limited to Kiteworks Core deployments using the optional, separately licensed repository-connector feature. Exploitation requires an authenticated system administrator account and network egress from the appliance to an attacker-controlled system.
What level of access could an attacker obtain?
A successful attacker can inject commands and write arbitrary content to files owned by the service account that runs the connector. This can lead to code execution in that service account's context.
What conditions are required for exploitation?
The attacker must be able to supply a path to the repository connector while authenticated as a system administrator. The appliance must also be able to make outbound network connections to infrastructure controlled by the attacker.