Two cluster-management operations in Kiteworks Core failed to validate externally supplied file paths, enabling an attacker with root privileges on one cluster node to write files as root on another node and cause their execution. This vulnerability requires backend root access on a cluster node and that the target node has a pending software patch. The CVSS 3.1 score is 6.7 (medium severity) with attack vector local, high attack complexity, high privileges required, no user interaction, scope changed, low confidentiality impact, high integrity impact, and low availability impact.

An attacker with root access on one node of a Kiteworks Core cluster can write and execute files as root on another node, potentially leading to privilege escalation and unauthorized code execution across cluster nodes. Confidentiality impact is low, but integrity impact is high, and availability impact is low. Exploitation requires significant privileges and conditions, limiting the attack surface.

No explicit patch or remediation details are provided in the vendor advisory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict root access to cluster nodes and monitor for unauthorized file writes between nodes.