What is the CVSS score of CVE-2026-23636?

CVE-2026-23636 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Kiteworks are affected by CVE-2026-23636?

Organizations using Kiteworks Secure Data Forms should be aware of moderate risk from CVE-2026-23636, a unrestricted file upload vulnerability rated CVSS 5.5.. A patch is available.

How to fix or mitigate CVE-2026-23636?

Within 30 days: Identify affected systems running Kiteworks Secure Data Forms and apply vendor patches as part of regular patch cycle. Review file handling controls.

Kiteworks CVE-2026-23636

EUVD-2026-15541 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-25 GitHub_M

File Upload Kiteworks Secure Data Forms

5.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

9.2.1

EUVD ID Assigned

Mar 25, 2026 - 17:17 euvd

EUVD-2026-15541

Analysis Generated

Mar 25, 2026 - 17:17 vuln.today

CVE Published

Mar 25, 2026 - 16:58 nvd

MEDIUM 5.5

DescriptionGitHub Advisory

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, the manager of a form could potentially exploit an Unrestricted Upload of File with Dangerous Type due to a missing validation. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

AnalysisAI

Kiteworks Secure Data Forms contains an unrestricted file upload vulnerability (CWE-434) that allows form managers to upload files with dangerous types due to missing input validation. An authenticated attacker with manager privileges can exploit this to upload malicious files, potentially leading to code execution or system compromise. The vulnerability affects all versions prior to 9.2.1, and a patch is available; no public exploit code has been confirmed, but the moderate CVSS score of 5.5 reflects the high integrity impact combined with the requirement for elevated privileges.

Technical ContextAI

The vulnerability resides in Kiteworks Secure Data Forms, a component of the Kiteworks Private Data Network (PDN) platform designed to facilitate secure data exchange. The root cause is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), a critical input validation flaw where the application fails to properly validate or restrict file types during upload operations. This validation gap exists in the form management functionality, specifically in code paths accessible to users with manager-level privileges. The lack of proper file type checking, MIME type validation, and execution prevention mechanisms allows dangerous file extensions or executable content to bypass security controls and be stored on the server.

RemediationAI

Immediately upgrade Kiteworks to version 9.2.1 or later, which contains the patch for this vulnerability. The vendor has provided the fix in the official release, and deployment should be prioritized given the file upload nature of the flaw. Until patching is completed, implement compensating controls by restricting form manager access to trusted administrators only, disabling upload functionality if not critical, and ensuring the upload directory is not executable by the web server (verify file permissions and web server configuration to prevent execution of uploaded files). Monitor upload activity logs for suspicious file types or patterns. Organizations unable to immediately patch should contact Kiteworks support for guidance on temporary mitigations specific to their deployment.