CVE-2026-45221

The record

Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing directory resides in a location writable by any authenticated local user, enabling attackers to create the directory and place malicious files that execute at the privilege level of the user or service account that launches Konga, facilitating privilege escalation.

Affected packages

Related vulnerabilities

• CVE-2026-87530 Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows… CWE-427
• CVE-2026-76199 Photoshop Desktop is affected by an Uncontrolled Search Path Element vulnerability that… CWE-427
• CVE-2026-19590 OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks… CWE-427
• CVE-2026-82649 SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an… CWE-427
• CVE-2026-65093 NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a… CWE-427
• CVE-2026-50773 An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote… CWE-427
• CVE-2026-56090 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path… CWE-427
• CVE-2026-0294 A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent… CWE-427