Konga before version 2.1.0 contains a vulnerable hardcoded OpenSSL configuration path. The flaw allows a low‑privileged local user to place attacker‑controlled OpenSSL library or configuration files in this path. When Konga starts, it automatically loads these files, enabling the attacker to execute arbitrary code with the privilege level of the Konga process. Because the vulnerability is based on an untrusted search path (CWE‑427), the attacker can inject code that runs as the service account that launches Konga, raising local privileges. The vulnerability therefore facilitates local privilege escalation and could be leveraged to compromise the host.

The affected product is Konga from EASYBYTE Software. All Konga installations running any version earlier than 2.1.0 are vulnerable. The issue is most relevant on Windows where the missing directory path is writable by all authenticated users, allowing the local attacker to create the required directory and drop malicious files. Linux or other OS configurations may also be vulnerable if the hardcoded path is writable, but the referenced advisory focuses on Windows.

The CVSS score of 8.5 indicates a high severity vulnerability, and the EPSS score is not available, but the lack of a KEV listing does not mitigate the local risk. Inferred attack vector is local: any authenticated user on the host that can write to the hardcoded directory can create a malicious library or configuration file. Once Konga is restarted or launched, the injected code runs at the privilege level of the service account, thereby converting a local low‑privileged attack into a higher privilege compromise of the host. The combination of a high CVSS score and the unfettered local write access creates a significant risk for environments where Konga runs with elevated privileges.