Path Traversal Vulnerability in Kiteworks Appliance Setup Interface

CVE-2026-102123

What is CVE-2026-102123?

The Kiteworks appliance features a setup interface that fails to restrict user-supplied file paths to designated directories. This flaw could permit an unauthenticated attacker to manipulate file paths, enabling them to write files to any location that the service account is allowed to access. Such exploitation could lead to compromised appliance integrity or make the appliance unavailable until an administrative intervention is performed. Accessing the vulnerable interface typically requires network access that may be available during the initial provisioning of the appliance or due to custom configurations that deviate from the standard security setup.

References