CVE-2026-102141: Kiteworks Core Privilege Escalation through External Control of File Name or Path
Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a pending software patch present on the target node.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Kiteworks Core clusters are exposed when an attacker already has backend root access to one cluster node and another node has a pending software patch. The issue enables the attacker to affect a different node in the same cluster.
What access and conditions are required for exploitation?
An attacker needs root-level backend access on a cluster node. Exploitation also requires a pending software patch to be present on the target node.
What can an attacker do if exploitation succeeds?
The attacker can write files as root to another cluster node through the affected cluster-management operations and cause those files to be executed on that node.