{"id":"CVE-2026-102133","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-102133","generatedAt":"2026-10-28T00:57:09.767Z","title":"An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network…","description":"An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control.","published":"2026-09-30T21:17:02.000Z","lastModified":"2026-10-08T13:45:08.000Z","status":"Analyzed","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","cvss":{"version":"3.1","score":6.6,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-77"],"affected":["accellion/kiteworks"],"epss":{"score":0.01232,"percentile":0.68769,"date":"2026-10-26","history":[{"date":"2026-10-01","score":0.00551,"percentile":0.44046}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.23%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-30T21:17:02.000Z","detail":{"score":"6.6","severity":"MEDIUM","publishedAt":"2026-09-30T21:17:01.910Z"},"summary":"New CVE, medium severity (CVSS 6.6)."}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-53qp-jmrc-2g5j","tags":["Vendor Advisory"],"source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","tags":["Broken Link"],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102133","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}