{"id":"CVE-2026-102125","published":"2026-09-30T21:17:00.813","lastModified":"2026-10-01T14:17:16.770","description":"The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-653","CWE-668"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-58j2-hj9r-c258","tags":[]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","tags":[]}],"exploitRefs":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-58j2-hj9r-c258","tags":[]}],"hasPoc":true,"ai":{"summary":"This flaw allows code running within a sandbox to escape its confinement, potentially enabling an attacker to read, modify, or disrupt the service with the privileges of the service account.","exploitability":"Exploitation requires access to the sandboxed environment and the ability to execute code within it. Precondition is the presence of a vulnerability in the sandbox isolation mechanism.","blast_radius":"If exploited, the attacker could read or modify application data and configuration, or disrupt the service, impacting the availability and integrity of the affected appliance.","remediation":"Disable the affected feature or upgrade to the specific version mentioned in the advisory, e.g., 'Upgrade to 2.590 or later'.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","confine-bypass","service-disruption","isolation-failure"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:51:33.027Z"}}