ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-102133

Kiteworks Core Arbitrary File Write through Command Injection

CVSS 3.1 6.6 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-102133

Published

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-102133

Published

Core

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Kiteworks",
                    "product": "Core",
                    "defaultStatus": "unknown",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThan": "9.5.1",
                            "versionType": "custom"
                        },
                        {
                            "version": "9.5.1",
                            "status": "unaffected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON