Threats affecting pkg:github/kiteworks/core

CVE-2026-102137 is a vulnerability in Kiteworks Core that allows an authenticated administrator to bypass content validation during administrative file uploads, enabling storage of files with dangerous content on the appliance. This vulnerability alone does not lead to code execution, as exploiting that would require another separate vulnerability.

CVE-2026-102138 is a server-side request forgery (SSRF) vulnerability in Kiteworks Core. It affects versions prior to 9.5.1 and requires an authenticated administrator on a node with the licensed gateway role enabled. The vulnerability allows the administrator to supply a connector URL that the server retrieves without sufficient validation, potentially causing requests to internal network services. The CVSS score is low (3.3), reflecting limited impact and high attack complexity.

Kiteworks Core versions before 9.5.0 contain a deserialization vulnerability (CWE-502) that could allow remote code execution if an attacker can influence the deserialized data. Exploitation requires the attacker to control the input data, so the vulnerability is not exploitable on its own. The issue is rated high severity with a CVSS score of 8.1.

CVE-2026-102140 is a vulnerability in Kiteworks Core where an authenticated administrator can import files without full verification of their contents. The import process only validates the file header, allowing unverified or forged content to be processed. This flaw affects data integrity but does not impact confidentiality or availability. The vulnerability affects Kiteworks Core versions prior to 9.5.1. The CVSS score is 4.9, indicating a medium severity level.

CVE-2026-102141 is a vulnerability in Kiteworks Core cluster-management operations where file paths supplied were not validated. This allows an attacker with root access on one cluster node to write files as root onto another node, potentially causing execution there. Exploitation requires high privileges (root) on a backend node and the presence of a pending software patch on the target node. The vulnerability affects Kiteworks Core versions prior to 9.5.1.

CVE-2026-102142 is a high-severity vulnerability in the Kiteworks Core appliance where a system notification template is processed by a template engine that evaluates expressions within the template body. An authenticated System Administrator can craft a malicious template that, when the notification is sent, executes operating system commands on the appliance. This vulnerability affects Kiteworks Core versions from initial up to but not including 9.5.1.

Kiteworks Core versions prior to 9.5.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows an authenticated user to submit malicious content that executes arbitrary JavaScript in the context of another user's authenticated session when viewed. Such exploitation could enable actions on behalf of the victim, including potential account takeover of users with elevated privileges. Exploitation requires the victim to view the malicious content. The vulnerability has a high severity rating with a CVSS score of 8.7.

CVE-2026-102147 is a critical stored cross-site scripting (XSS) vulnerability in Kiteworks Core. An unauthenticated attacker can inject malicious content that executes arbitrary JavaScript in the session of an administrator viewing the affected page. This can lead to full administrative control, including creating new admin accounts. The vulnerability affects Kiteworks Core versions from 0 up to but not including 9.5.1. No patch information is provided in the available data.

CVE-2026-102145 is a vulnerability in Kiteworks Core where an authenticated administrator can exploit improper neutralization of CRLF sequences (CRLF Injection). This flaw allows the server to issue requests to internal network services that should not be accessible through the interface. The vulnerability does not lead to code execution by itself.

Kiteworks Core versions prior to 9.5.0 contain an OS Command Injection vulnerability. This flaw allows an authenticated administrator to upload a specially crafted configuration package that is not properly validated. Exploiting this vulnerability could lead to arbitrary command execution on the underlying system with potentially elevated privileges.

Kiteworks Core versions prior to 9.5.0 contain a path traversal vulnerability (CWE-22) in an administrative export feature. This flaw allows an authenticated administrator to write files to arbitrary locations on the host system, which could lead to command execution on the appliance. Exploitation requires valid administrative credentials and access to the vulnerable export function.

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.

Kiteworks Core versions prior to 9.5.0 contain a stored SQL injection vulnerability in an administrative reporting feature. This flaw allows an authenticated administrator to read sensitive database information and potentially disrupt service availability. Exploitation requires valid administrative credentials and access to the vulnerable reporting function.