CVE-2026-102142 Kiteworks Core Remote Code Execution through Server-Side Template Injection

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...

CVE-2026-102142

The Kiteworks appliance is vulnerable to Remote Code Execution due to a Server-Side Template Injection flaw in the system notification template rendering process. The underlying cause is a template engine that evaluates expressions contained within the stored template body. An authenticated Syste...

CVE-2024-52292 Craft Allows Attackers to Read Arbitrary System Files

Craft is a content management system CMS. The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function...

CVE-2024-52292

CVE-2024-52292 affects Craft CMS. The dataUrl function can exfiltrate the contents of arbitrary server files when an attacker has write permissions on system notification templates and can trigger a system email. By embedding a path to a sensitive file, the Base64-encoded content is sent via an e...