Kiteworks Core has an OS Command Injection

Kiteworks allows authenticated users to redirect command output to arbitrary files, potentially overwriting critical system files and gaining elevated access. This is a command injection vulnerability that requires an existing user account to exploit.

CWE-78 OS Command Injection in Kiteworks Core prior to 9.2.0 allows authenticated users to manipulate command output redirection to arbitrary file paths. The vulnerability enables file overwrite attacks on system files, potentially leading to privilege escalation. Attack vector requires valid authentication credentials and access to the vulnerable command execution functionality.