CVE-2026-45221: Uncontrolled Search Path Element in EASYBYTE Software Konga

CVE-2026-45221 is a privilege escalation vulnerability in EASYBYTE Software's Konga product prior to version 2.1.0. The flaw arises from an uncontrolled search path element where Konga loads OpenSSL configuration or library files from a hardcoded directory that does not exist by default. On Windows systems, this directory is located in a path writable by any authenticated local user, allowing attackers to create the directory and plant malicious files. When Konga launches, these malicious files execute with the privileges of the user or service account running the application, enabling privilege escalation.

An attacker with low-level local access can escalate privileges by placing malicious OpenSSL-related files in a writable, hardcoded directory path. This can lead to arbitrary code execution at the privilege level of the user or service account running Konga, potentially compromising system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user permissions to prevent creation or modification of the vulnerable directory path. Monitor for updates from EASYBYTE Software regarding patches or official mitigations.