This vulnerability involves improper neutralization of special elements in an OS command context (CWE-78) combined with privilege escalation (CWE-269) in Kiteworks Core. An attacker who has already compromised one node in a clustered environment can exploit insufficient input validation in an internal cluster management function to execute operating system commands with elevated privileges on other nodes within the same cluster. The affected function is not reachable from outside the cluster, limiting exploitation to attackers with existing node-level access.

Successful exploitation allows an attacker with limited privileges on one cluster node to escalate privileges and execute arbitrary OS commands on other nodes in the cluster. This can lead to full compromise of the cluster environment, including confidentiality, integrity, and availability impacts. The vulnerability has a CVSS 3.1 score of 8.8 (high severity) reflecting its potential for significant impact within the cluster.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since exploitation requires prior node access and the vulnerable function is internal to the cluster, limiting access to cluster nodes and monitoring for unauthorized node access can reduce risk until a fix is available.