Vulnerability in Kiteworks Appliance Document Conversion Sandbox
CVE-2026-102125

8.8HIGH

Key Information:

Vendor

Kiteworks

Status
Core
Vendor
CVE Published:
30 September 2026

What is CVE-2026-102125?

A security oversight in the Kiteworks appliance's document conversion sandbox allows code running within it to escape confinement. This weakness can be exploited by attackers to execute commands with the privileges of the service account, potentially enabling them to access, modify, or disrupt application data and configurations. The vulnerability raises significant concerns regarding the integrity and availability of the service.

Affected Version(s)

Core 0 < 9.5.0

Core 9.5.0

References

https://github.com/kiteworks/security-advisories/security...
vendor-advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
third-party-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Icare, https://yeswehack.com/hunters/icare
Supr4s, https://yeswehack.com/hunters/Supr4s
wlayzz, https://yeswehack.com/hunters/wlayzz
truff, https://yeswehack.com/hunters/truff
.