CVE-2026-102099 in Kiteworks
Summary
by MITRE • 10/01/2026
Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an arbitrary location on the underlying host, potentially leading to command execution on the appliance. Exploitation requires an existing, authenticated administrative account with access to the affected export function.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Kiteworks Core versions prior to 9.5.0 represents a critical security flaw classified as Arbitrary File Write. This issue stems from improper restriction of user-supplied file paths within the application's administrative export functionality. In secure software design, any mechanism that allows users or administrators to specify output locations must rigorously validate and sanitize those inputs to prevent path traversal attacks. The failure in Kiteworks Core lies in its inability to properly constrain these paths, allowing an attacker to manipulate the destination directory structure using standard relative path sequences such as dot-dot-slash notation. This lack of validation enables the writing of files outside the intended application directories, effectively bypassing the sandbox or isolation boundaries established by the software architecture.
From a technical perspective, this flaw aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The vulnerability is particularly severe because it affects an administrative feature, which implies that exploitation requires a higher level of initial access compared to unauthenticated remote code execution vulnerabilities. However, the impact of successful exploitation is significant. By writing arbitrary files to specific locations on the underlying host operating system, an authenticated administrator can potentially place malicious scripts or binaries in directories that are executed by system services or scheduled tasks. This capability directly facilitates Command Execution, as defined under CWE-78: Improper Neutralization of Special Elements used in an OS Command. If the attacker can write to a location such as /etc/cron.d/ on Linux-based appliances or equivalent startup directories, they may achieve persistent remote code execution with elevated privileges.
The operational impact of this vulnerability extends beyond simple file manipulation. An adversary who exploits this flaw could compromise the integrity and availability of the Kiteworks appliance itself. Since administrative accounts often possess broad permissions within the application ecosystem, gaining arbitrary write access to the host OS can lead to full system takeover. This compromises not only the confidentiality of data stored within the platform but also the security posture of any connected systems or networks that trust this appliance for secure file transfer and collaboration. The ability to execute commands remotely means an attacker could install backdoors, exfiltrate sensitive information directly from the filesystem, or pivot further into internal network segments depending on the deployment context.
Mitigation strategies must focus primarily on immediate patching and access control hardening. Organizations running Kiteworks Core versions earlier than 9.5.0 should upgrade to the latest stable release where this path validation logic has been corrected by the vendor. Until patches are applied, it is advisable to restrict administrative access strictly through multi-factor authentication and network segmentation to limit exposure to potential attackers who may have compromised lower-privilege accounts. Additionally, implementing file integrity monitoring on critical system directories can help detect unauthorized writes that might indicate an active exploitation attempt. Security teams should also review audit logs for unusual export activities or unexpected file creation events in sensitive paths as part of their ongoing threat detection efforts.
This vulnerability is mapped to the MITRE ATT&CK framework under T1505: Server Software Component, specifically relating to Web Shell techniques if a web-accessible script is written and executed. It also relates to T1059: Command and Scripting Interpreter through the potential for subsequent command execution steps following the initial file write. Understanding these mappings helps security operations centers prioritize response actions based on known adversary behaviors associated with server-side vulnerabilities that lead to persistent access or lateral movement capabilities within enterprise environments.