CVE-2026-102133

6.6 Moyenne

Publiée le 30/09/2026 à 23:17 · Modifiée le 08/10/2026 à 15:45 · Analysée par le NVD · Source : 9119a7d8-5eab-497f-8521-727c672e3725

Description

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control.

Traduire en français

Produits concernés

Kiteworks Core
Accellion kiteworks

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.6 Moyenne	9119a7d8-5eab-497f-8521-727c672e3725	`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-77

Références

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-53qp-jmrc-2g5j Vendor Advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json Broken Link

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories