Threats affecting pkg:github/ellanetworks/core

CVE-2026-102112 is a privilege escalation vulnerability in Kiteworks Core that allows an attacker with existing code execution as an unprivileged backend service account to escalate privileges to root and execute arbitrary commands with highest privileges. Exploitation requires local access to the service account. The vulnerability is due to improper neutralization of special elements used in OS commands (CWE-78).

CVE-2026-102113 is a privilege escalation vulnerability in Kiteworks Core that allows an attacker with local access as an unprivileged backend service account to escalate privileges to root. The issue arises from improper handling of filesystem paths by a privileged routine, enabling arbitrary command execution with root privileges. Exploitation requires prior code execution under the lower-privileged service account. The vulnerability affects Kiteworks Core versions prior to 9.5.0.

CVE-2026-102114 is a command injection vulnerability in Kiteworks Core that allows a high-privileged authenticated administrator to execute arbitrary OS commands as root on the appliance node. Exploitation requires an administrative account with elevated privileges. The vulnerability affects versions prior to 9.5.0. The CVSS score is 7.2, indicating high severity.

Kiteworks Core contains a critical vulnerability in its password reset workflow that allows an unauthenticated attacker to reset a user's password without access to the reset email link. This flaw affects versions prior to 9.5.0 and can lead to full account takeover, including accounts with administrative privileges.

CVE-2026-102117 is a high-severity vulnerability in Kiteworks Core affecting versions prior to 9.5.1. It allows an authenticated System Administrator with access to a key protecting submitted data to redirect the system's outbound support connection to an attacker-controlled destination. This redirection can lead to remote code execution with the privileges of a local service account.

CVE-2026-102118 is a local privilege escalation vulnerability in Kiteworks Core that allows an attacker with a low-privileged shell to escalate to root privileges on the appliance. The flaw involves improper link resolution before file access, categorized under CWE-59. It affects Kiteworks Core versions from 0 up to but not including 9.5.0. The vulnerability has a high severity with a CVSS score of 7.8.

CVE-2026-102120 is a high-severity OS command injection vulnerability in Kiteworks Core affecting versions before 9.5.1. It allows an attacker with existing code execution on one cluster node to escalate privileges and execute OS commands on other nodes within the same cluster. The flaw arises from insufficient input validation in an internal cluster management function, which is not accessible externally and requires prior node access.

CVE-2026-102122 is an authorization vulnerability in Kiteworks Core where users with the Manager role on a shared folder could improperly assign the Owner role to themselves or others. This occurs due to incorrect enforcement of role assignment permissions. The vulnerability affects versions prior to 9.5.1. The CVSS score is 4.3, indicating medium severity with limited impact on integrity and no impact on confidentiality or availability.

CVE-2026-102123 is a path traversal vulnerability in the Kiteworks Core appliance setup interface. It allows an unauthenticated attacker to write files outside the intended directory, potentially compromising the appliance's integrity or causing denial of service. Exploitation requires network access to the setup interface, which is not accessible in the default fully configured appliance but may be reachable during initial provisioning or non-default configurations. The vulnerability affects Kiteworks Core versions prior to 9.5.0.

CVE-2026-102124 is a vulnerability in the Kiteworks Core appliance setup interface where authentication is not enforced after initial configuration. This allows an unauthenticated attacker with network access to read and modify certain setup records such as contact name and email address. The vulnerability affects versions prior to 9.5.0. The CVSS score is 6.5, indicating a medium severity impact with limited confidentiality and integrity impact but no availability impact.

CVE-2026-102125 is a high-severity vulnerability in Kiteworks Core where the sandbox used for document conversion does not fully isolate the code running inside it. This allows code executing within the sandbox to escape confinement and operate with the privileges of the service account running the application. Exploitation could enable an attacker to read or modify application data and configuration or disrupt the service on the affected appliance.

CVE-2026-102126 is a stored cross-site scripting (XSS) vulnerability in Kiteworks Core. It allows a lower-privileged administrator with a narrowly scoped delegated permission to store malicious content. This content executes arbitrary JavaScript in the session of a System Administrator who views the affected page, potentially escalating privileges to full administrative control, including creating new admin accounts. The vulnerability affects Kiteworks Core versions from 0 up to but not including 9.5.1. The CVSS score is 8.1, indicating high severity.

CVE-2026-102129 is a privilege escalation vulnerability in Kiteworks Core where the user-provisioning interface fails to verify if an administrator is authorized to assign certain roles. This flaw allows an administrator with limited delegated permissions for role changes to escalate an account to full system-administrator privileges. The vulnerability affects Kiteworks Core versions from 0 up to but not including 9.5.1. It has a high severity with a CVSS score of 7.2. No known exploits are reported in the wild, and no patch information is provided.

CVE-2026-102132 is a high-severity vulnerability in Kiteworks Core where an administrative import function fails to verify if a delegated administrator is authorized to create privileged integration credentials. This flaw allows a delegated administrator with limited permissions to escalate privileges to full system administrator without intervention from an existing system administrator. The vulnerability affects Kiteworks Core versions prior to 9.5.1.

CVE-2026-102133 is a command injection vulnerability in the Kiteworks Core product affecting an optional repository-connector feature. This flaw allows an authenticated system administrator to inject commands via a user-supplied path that is not properly neutralized before being passed to an external command. Successful exploitation could lead to arbitrary code execution under the service account running the connector, requiring network egress to an attacker-controlled system. The vulnerability affects Kiteworks Core versions prior to 9.5.1.

CVE-2026-102134 is a medium severity vulnerability in Kiteworks Core where gateway-level API security controls were not applied to all requests authenticated via the central authentication service. This allowed authenticated users to access REST API functionality through alternate request paths that bypassed controls such as enforcement of signed-out and revoked sessions.

CVE-2026-102136 is a vulnerability in Kiteworks Core affecting multi-node deployments. An attacker with code execution on one node can submit crafted input via an internal cluster interface, which is insufficiently validated when written into monitoring configuration on another node. This can lead to execution of OS commands under an unprivileged service account on the second node. The vulnerability is classified as a CRLF injection (CWE-93) and impacts versions prior to 9.5.1. The CVSS score is 6.3, indicating a medium severity.

CVE-2026-102137 is a vulnerability in Kiteworks Core that allows an authenticated administrator to bypass content validation during administrative file uploads, enabling storage of files with dangerous content on the appliance. This vulnerability alone does not lead to code execution, as exploiting that would require another separate vulnerability.

CVE-2026-102138 is a server-side request forgery (SSRF) vulnerability in Kiteworks Core. It affects versions prior to 9.5.1 and requires an authenticated administrator on a node with the licensed gateway role enabled. The vulnerability allows the administrator to supply a connector URL that the server retrieves without sufficient validation, potentially causing requests to internal network services. The CVSS score is low (3.3), reflecting limited impact and high attack complexity.

Kiteworks Core versions before 9.5.0 contain a deserialization vulnerability (CWE-502) that could allow remote code execution if an attacker can influence the deserialized data. Exploitation requires the attacker to control the input data, so the vulnerability is not exploitable on its own. The issue is rated high severity with a CVSS score of 8.1.