Kiteworks Core CVE-2026-102099

Requires an existing, authenticated administrative account with access to the affected Kiteworks 'administrative export' feature (versions before 9.5.0). The attacker must be able to reach the admin web interface over the network and supply a user-controlled file path to the export function. Limiting factors: high privilege requirement (administrative role), the flaw is not reachable by unauthenticated or standard users, and command execution is a downstream consequence dependent on writing to an executable/triggered location on the host rather than being guaranteed by the write alone.

This is a genuine but access-gated risk. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) is internally consistent with the description: network-reachable admin interface (AV:N), low complexity (AC:L), but requiring high privileges (PR:H) since exploitation needs an existing authenticated administrative account with access to the export function. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. The C:H/I:H/A:H impact is justified because an arbitrary file write to the underlying host can escalate to command execution on the appliance (e.g., overwriting cron jobs, service configs, or web-root scripts), which would give full compromise. Net: real priority only where untrusted or lower-trust operators hold admin accounts, or as a post-authentication escalation step; the PR:H barrier makes mass/opportunistic exploitation unlikely, so this is a High-but-privilege-limited issue rather than an internet-wide emergency. No conflicting signals were observed between the vector and the description.

An authenticated Kiteworks administrator (or an attacker who has phished/compromised admin credentials) invokes the administrative export feature and supplies a crafted file path containing traversal sequences, causing the appliance to write attacker-controlled file content to an arbitrary location on the host. By targeting a location such as a cron directory, startup script, or web-executable path, the attacker converts the file write into command execution on the appliance. No public exploit code is identified at time of analysis.