CVE-2026-102133

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control.

CVSS v3 6.6 MEDIUM

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-53qp-jmrc-2g5j	Vendor Advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*

History

08 Oct 2026, 13:45

Type	Values Removed	Values Added
First Time		Accellion Accellion kiteworks
References	~~() https://github.com/kiteworks/security-advisories/security/advisories/GHSA-53qp-jmrc-2g5j -~~	() https://github.com/kiteworks/security-advisories/security/advisories/GHSA-53qp-jmrc-2g5j - Vendor Advisory
References	~~() https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json -~~	() https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json - Broken Link
CPE		cpe:2.3:a:accellion:kiteworks::::::::

30 Sep 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-30 21:17

Updated : 2026-10-08 13:45

NVD link : CVE-2026-102133

Mitre link : CVE-2026-102133

CVE.ORG link : CVE-2026-102133

JSON object : View

Products Affected

accellion

kiteworks

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2026-102133", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102133", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-01T13:23:37.406475Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.7}]}, "affected": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "affectedData": [{"vendor": "Kiteworks", "product": "Core", "versions": [{"status": "affected", "version": "0", "lessThan": "9.5.1", "versionType": "custom"}, {"status": "unaffected", "version": "9.5.1"}], "defaultStatus": "unknown"}]}], "published": "2026-09-30T21:17:01.910", "references": [{"url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-53qp-jmrc-2g5j", "tags": ["Vendor Advisory"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json", "tags": ["Broken Link"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control."}], "lastModified": "2026-10-08T13:45:08.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3DAD823-F1FD-402B-86A5-C69DD8261D4B", "versionEndExcluding": "9.5.1"}], "operator": "OR"}]}], "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725"}