Kiteworks Core CVE-2026-102137

Requires an authenticated administrator account on the Kiteworks Core appliance (PR:H) with access to the administrative file-upload function, and the attacker must craft a file that specifically bypasses the server-side content validation applied to that upload (AC:H). Exploitation is capped by the fact that storing the file does not by itself execute it - code execution would require a separate, chained vulnerability. Affected builds are Kiteworks Core versions before 9.5.1; upgrading to 9.5.1 removes the flaw. There is no user-interaction requirement, but the high privilege prerequisite means only a malicious or compromised administrator can reach it.

This is a low-priority issue despite the CWE-434 'unrestricted file upload' classification, and the signals are internally consistent. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L, 4.1) is the key constraint: PR:H means the attacker must already hold administrative credentials on the Kiteworks Core appliance, and AC:H reflects that the content-validation control must be actively evaded with a crafted file. Most importantly, the description explicitly states the flaw 'did not by itself result in code execution,' so the 'RCE' tag overstates real-world impact - realizing code execution would require chaining a separate, unidentified vulnerability. There is no EPSS score, no CISA KEV listing, and no public POC, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision record is provided. The only mild tension is the CWE-434/RCE framing versus the description's own admission of no direct execution; treat the raw CWE as aspirational and weight the description. Net: a defense-in-depth hardening fix for an already-privileged actor, not an urgent remediation.

An attacker who has already obtained Kiteworks Core administrator credentials crafts a file whose contents evade the administrative upload's content validation and stores it on the appliance filesystem. On its own this only plants dangerous content; the attacker would then need a second, separate vulnerability to cause the stored file to be executed. No public exploit code exists for this issue.