Command Injection Vulnerability in Kiteworks Core Affecting Service Accounts

CVE-2026-102133

What is CVE-2026-102133?

A command injection vulnerability exists in Kiteworks Core's repository-connector feature, which fails to properly neutralize special characters in user-supplied paths. An authenticated system administrator can exploit this weakness by injecting additional commands, potentially leading to arbitrary file writes under the privileges of the associated service account. Successful exploitation also necessitates network egress to a system controlled by the attacker, allowing for further compromise. This vulnerability highlights the importance of proper input validation and security measures to prevent unauthorized command execution.

References