CVE-2026-102137

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate vulnerability to place the file in an executable location.

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance when the notification was next sent.

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution was limited to an unprivileged service account on that node.

The sandbox isolating document conversion on a Kiteworks appliance did not fully confine code, potentially allowing escape and execution with the service account's privileges. An attacker could read or modify application data and configuration, or disrupt the service.

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured during initial configuration.

A Kiteworks appliance setup interface did not confine a user-supplied file path, allowing an unauthenticated attacker to write files to arbitrary writable locations. Exploitation requires network access to the interface, which is not reachable on a fully configured appliance by default.

Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding the Manager role on a folder could grant the Owner role to themselves or to other members of that folder.

A privilege escalation vulnerability in Kiteworks could allow an attacker with code execution on one cluster node to run OS commands with elevated privileges on another node. Insufficient input validation in an internal cluster management function allowed attacker-supplied values to reach a privileged context.

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations. This could potentially be leveraged to execute arbitrary code on the underlying system.

A local privilege escalation vulnerability in Kiteworks could allow an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance.