CVE-2026-102142: Kiteworks Core Remote Code Execution through Server-Side Template Injection
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance when the notification was next sent.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated as a System Administrator and able to store a crafted system notification template.
When does the malicious template execute?
The operating-system command execution can occur when the crafted notification template is next rendered for sending. This may delay exploitation until a notification using that template is sent.
What is the potential impact if exploitation succeeds?
A successful exploit could allow operating-system command execution on the Kiteworks appliance, with high impact to confidentiality, integrity, and availability.