This vulnerability (CVE-2026-102145) in Kiteworks Core is classified as CWE-93 (Improper Neutralization of CRLF Sequences). It allows an authenticated administrator to manipulate the server into interacting with internal network services that should be unreachable via the affected interface. Although this can lead to unintended internal requests, it does not directly result in remote code execution. The issue affects all Kiteworks Core versions prior to 9.5.1. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and low confidentiality, integrity, and availability impacts.

An authenticated administrator can exploit this vulnerability to cause the Kiteworks Core server to interact with internal network services that are normally inaccessible through the interface. This could potentially expose internal services or data, but does not lead to code execution or direct system compromise. The impact is limited to confidentiality, integrity, and availability at a low level, with a medium overall severity rating.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for unusual internal network interactions initiated by the Kiteworks Core server.