EUVD-2026-90292
GHSA-fhrr-6c58-49wq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attacker must already execute code inside the conversion sandbox (AV:L/PR:L), escape is low-complexity and crosses the sandbox→service-account boundary (S:C), granting full data/config read, modify, and disruption (C:H/I:H/A:H).
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
5DescriptionCVE.org
The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.
AnalysisAI
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing inside the conversion sandbox to break confinement and act with the privileges of the application service account, enabling reads or modifications of application data and configuration or disruption of the service. Exploitation is conditional: the attacker must first get code running inside the sandbox, typically by submitting a crafted document for conversion, and the CVSS vector (AV:L/PR:L/UI:N/S:C) confirms a local, low-privilege prerequisite with no user interaction once that foothold exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already be running code inside the Kiteworks Core appliance's document-conversion sandbox - the feature that isolates document/file conversion - which in practice means first getting attacker-controlled content executed by the conversion engine (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional integrity/availability risk rather than a mass-exploitation threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary remediation is to apply the vendor-released fixes documented in Kiteworks security advisory GHSA-58j2-hj9r-c258 (patch available per vendor advisory; the exact fixed version is not specified in the provided data, so consult the advisory for the version to upgrade to). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: verify whether Kiteworks Core document-conversion is enabled and identify any exposure; restrict submission of untrusted documents to conversion workflows; review application and sandbox logs for suspicious conversion activity; and check vendor advisory GHSA-58j2-hj9r-c258 for any interim guidance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to acc
Same weakness CWE-653 – Improper Isolation or Compartmentalization
View allShare
External POC / Exploit Code
Leaving vuln.today