CVE-2026-102142

Received Received - Intake

Authenticated Template Engine Command Injection in Kiteworks Appliance

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance when the notification was next sent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102142

EUVD

EUVD-2026-90271

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	kiteworks	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

This vulnerability involves a system notification template on the Kiteworks appliance that uses a template engine to render expressions in stored templates. An authenticated System Administrator could craft a template that executes operating-system commands when the notification is sent.

Impact Analysis

An attacker with System Administrator access could execute arbitrary operating-system commands on the appliance, potentially leading to unauthorized access, data theft, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Apply vendor-provided patches or updates for the Kiteworks appliance to address the template engine vulnerability. Restrict System Administrator privileges to only trusted users. Monitor appliance logs for unusual template modifications or command execution attempts.

Hi! I’m here to help you understand CVE-2026-102142. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70