Unauthenticated File Import Vulnerability in Kiteworks Product
CVE-2026-102140

4.9MEDIUM

Key Information:

Vendor

Kiteworks

Status
Core
Vendor
CVE Published:
30 September 2026

What is CVE-2026-102140?

An authenticated administrator could initiate an administrative import of a file without adequate verification of its contents, as the import mechanism only validates the file's header. This oversight may permit the acceptance and processing of unverified or potentially malicious content, thereby compromising the integrity and reliability of the imported data.

Affected Version(s)

Core 0 < 9.5.1

Core 9.5.1

References

https://github.com/kiteworks/security-advisories/security...
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Supr4s, https://yeswehack.com/hunters/Supr4s
wlayzz, https://yeswehack.com/hunters/wlayzz
Icare, https://yeswehack.com/hunters/icare
truff, https://yeswehack.com/hunters/truff
.