CVE-2026-102141 — Kiteworks Core Privilege Escalation through External Control of File Name or Path
Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root ont…
Published: 2026-09-30 · CVSS: 6.7 · CVSS 3.1
Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a pending software patch present on the target node.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7