CVE-2026-28269: medium-severity vulnerability in kiteworks security-advisories
Kiteworks Core has an OS Command Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Kiteworks allows authenticated users to redirect command output to arbitrary files, potentially overwriting critical system files and gaining elevated access. This is a command injection vulnerability that requires an existing user account to exploit.
CWE-78 OS Command Injection in Kiteworks Core prior to 9.2.0 allows authenticated users to manipulate command output redirection to arbitrary file paths. The vulnerability enables file overwrite attacks on system files, potentially leading to privilege escalation. Attack vector requires valid authentication credentials and access to the vulnerable command execution functionality.
In the same product, most dangerous first.