CVE-2026-45221

Konga before 2.1.0 is vulnerable to a search-path hijacking flaw (CWE-427): the application loads OpenSSL configuration or library files from a hardcoded filesystem path that does not exist in default installations. On Windows, this missing directory sits in a location writable by any authenticated local user, so a low-privileged local attacker can create the directory and plant a malicious OpenSSL configuration or library file there. When Konga next starts, it loads the planted files and the attacker's code executes at the privilege level of the user or service account that launches Konga, enabling privilege escalation — most impactfully when Konga runs under a dedicated service or administrative account. Only deployments of Konga on versions before 2.1.0 (notably on Windows) are affected, and exploitation requires local access with low privileges and no user interaction. There is no public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns a roughly 0.1% probability of exploitation within 30 days, so no exploitation is currently known.

What to do: Upgrade Konga to 2.1.0 or later. On Windows systems that cannot be upgraded, pre-create the hardcoded OpenSSL directory with write access restricted to administrators so low-privileged users cannot plant files, and verify which account launches Konga (prefer a low-privilege service account). Defenders can also monitor for creation of unexpected OpenSSL configuration or library files in that path.