Description

Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing directory resides in a location writable by any authenticated local user, enabling attackers to create the directory and place malicious files that execute at the privilege level of the user or service account that launches Konga, facilitating privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-01T20:17:14.680Z",
  "pubdate": "2026-09-01T20:17:14.680Z",
  "executiveSummary": "Konga versions prior to 2.1.0 are susceptible to a local privilege escalation vulnerability caused by insecure file handling and directory creation logic on Windows systems.\nThe vulnerability arises because the application checks for and utilizes OpenSSL configuration or library files from a hardcoded filesystem path that does not exist by default.\nBecause the parent directory of this hardcoded path is writable by any authenticated local user, an attacker can manually create the directory structure and place malicious, attacker-controlled files within it.\nWhen Konga is subsequently launched, it processes these malicious files, resulting in arbitrary code execution under the security context of the user or service account executing the application.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the host system, as it allows low-privileged users to elevate their privileges to those of the Konga service account.",
  "technicalDetails": "The root cause of this vulnerability is an insecure dependency loading mechanism related to OpenSSL integration. The application attempts to load configuration files or libraries from a predefined, hardcoded path that is absent in standard installations.\nOn Windows environments, the parent directory or the specific path utilized by the application for these configuration files lacks restrictive access control lists (ACLs), effectively allowing any authenticated local user to create the directory hierarchy and populate it with arbitrary content.\nThe attack flow proceeds as follows: First, the attacker identifies the hardcoded path where the application searches for OpenSSL configuration or library files. Second, the attacker creates this directory structure, which is permitted due to permissive folder-level permissions for authenticated users on the target Windows system.\nThird, the attacker places a maliciously crafted OpenSSL configuration file or a dynamic library (DLL) into the target directory, designed to execute arbitrary payloads when loaded by the application's process.\nFinally, when the Konga service or the application binary is executed by a higher-privileged user or a system service account, the application inadvertently loads the attacker's malicious files during its initialization phase. Because the application processes these files with the elevated permissions of the host process, the attacker achieves arbitrary code execution within that context.\nThis vulnerability is strictly local, requiring the attacker to have an existing authenticated session on the host machine. The lack of validation on the integrity or origin of the loaded configuration/library files is the primary failure point. The impact of successful exploitation is full compromise of the application's process, enabling the attacker to perform any action permitted by the service account running Konga, including further lateral movement or privilege escalation to administrative levels on the host system."
}