Kiteworks Core is vulnerable to OS Command Injection because configuration packages are not properly validated when an authenticated administrator uploads them. A crafted package can cause the underlying operating system to execute arbitrary commands, potentially with elevated privileges, on the affected appliance. This flaw threatens confidentiality, integrity, and availability of the affected appliance.

Kiteworks Core appliances running any version prior to 9.5.0 are impacted. The vulnerability applies to all deployed installations that allow authenticated administrators to upload configuration packages.

The vulnerability has a CVSS score of 7.2, indicating high severity. The EPSS score is 3%, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is internal, requiring authenticated administrator access to upload configuration packages, though remote compromise of administrator credentials could also enable exploitation.