Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a pending software patch present on the target node.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 30 Sep 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a pending software patch present on the target node. | |
| Title | Kiteworks Core Privilege Escalation through External Control of File Name or Path | |
| Weaknesses | CWE-269 CWE-73 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: cisa-cg
Published:
Updated: 2026-09-30T20:10:55.599Z
Reserved: 2026-09-28T17:39:13.564Z
Link: CVE-2026-102141
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-30T21:17:02.903
Modified: 2026-09-30T21:17:02.903
Link: CVE-2026-102141
Redhat
No data.
OpenCVE Enrichment
No data.