Privilege Escalation Vulnerability in Konga by Easybyte

CVE-2026-45221

What is CVE-2026-45221?

Konga prior to version 2.1.0 has a vulnerability that allows local attackers with low privileges to escalate their access by executing arbitrary code. This is facilitated through the exploitation of a hardcoded filesystem path meant for OpenSSL configuration or library files, which is not present in default installations. On Windows systems, the vulnerable directory is writable by any authenticated local user. This opens the door for attackers to create the necessary directory and insert malicious files that operate under the privileges of the user or the Konga service, thus enabling unauthorized privilege escalation.

References