Description
A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering it unavailable until an operator intervenes. Exploitation requires network access to the affected interface, which is not reachable on a fully configured appliance in its default configuration; reaching it depends on either the transient window while an appliance is first being provisioned or a non-default appliance configuration.
Published: 2026-09-30
Score: 7.4 High
EPSS: n/a
KEV: No
Impact: Unrestricted File Write
Action: Apply Patch
AI Analysis

Impact

A Kiteworks Core appliance setup interface failed to constrain a user‑supplied file path; an unauthenticated attacker could write a file to any writable location under the service account, potentially overwriting critical files or installing malicious payloads, which may lead to integrity compromise or service disruption; this vulnerability is a directory traversal flaw (CWE-22).

Affected Systems

The vulnerability affects Kiteworks Core appliances; the exact product name is Kiteworks Core, and no specific version details are provided in the advisory.

Risk and Exploitability

The CVSS score of 7.4 indicates a high risk, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires network access to the setup interface, which is normally not exposed by a fully configured appliance; attackers would need to target the transient provisioning window or a non‑default configuration that exposes the interface.

Generated by OpenCVE AI on September 30, 2026 at 22:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict network exposure of the setup interface to a trusted administrative network or block external access entirely.
  • Apply the latest Kiteworks Core firmware or software update that addresses the path‑traversal flaw.
  • Verify that the service account running the appliance has write permissions limited to its intended directories and adjust file system permissions accordingly.
  • Monitor logs for unauthorized file creation or modification attempts.

Generated by OpenCVE AI on September 30, 2026 at 22:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
First Time appeared Kiteworks
Kiteworks core
Vendors & Products Kiteworks
Kiteworks core

Wed, 30 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering it unavailable until an operator intervenes. Exploitation requires network access to the affected interface, which is not reachable on a fully configured appliance in its default configuration; reaching it depends on either the transient window while an appliance is first being provisioned or a non-default appliance configuration.
Title Kiteworks Core Path Traversal
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Kiteworks Core
cve-icon MITRE

Status: PUBLISHED

Assigner: cisa-cg

Published:

Updated: 2026-09-30T20:16:01.901Z

Reserved: 2026-09-28T17:39:13.563Z

Link: CVE-2026-102123

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T21:17:00.517

Modified: 2026-10-01T02:17:43.350

Link: CVE-2026-102123

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T05:30:17Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')