Skip to main content

Kiteworks CVE-2026-28270

MEDIUM
Unrestricted Upload of File with Dangerous Type (CWE-434)
2026-02-27 security-advisories@github.com
4.9
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
4.9 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
CVE Published
Feb 27, 2026 - 21:16 nvd
MEDIUM 4.9

DescriptionGitHub Advisory

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue.

AnalysisAI

Kiteworks versions prior to 9.2.0 lack proper file validation in their configuration upload functionality, allowing authenticated administrators to upload arbitrary files to the system. An attacker with administrative privileges could exploit this to introduce malicious or unauthorized file types, potentially compromising system integrity. A patch is available in version 9.2.0 and later.

Technical ContextAI

Classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). Affects Kiteworks. Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue.

RemediationAI

Monitor vendor advisories for a patch. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.

CVE-2026-23514 HIGH
8.8 Mar 25

An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to acc

CVE-2026-24782 HIGH
8.8 Jun 01

SQL injection in Kiteworks Secure Data Forms lets an authenticated user holding the FormBuilder role read and tamper wit

CVE-2021-31586 HIGH
8.8 Jun 23

Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search. Rated high

CVE-2026-24752 HIGH
8.2 Jun 01

Reflected cross-site scripting in Kiteworks Secure Data Forms (versions prior to 9.3.0) allows remote unauthenticated at

CVE-2026-24751 HIGH
8.2 Jun 01

Reflected cross-site scripting in Kiteworks Secure Data Forms prior to version 9.3.0 allows external attackers to execut

CVE-2026-28272 HIGH
8.1 Feb 27

Kiteworks Email Protection Gateway prior to version 9.2.0 contains a stored cross-site scripting vulnerability in its co

CVE-2026-24750 HIGH
7.6 Mar 25

A stored cross-site scripting (XSS) vulnerability exists in Kiteworks Secure Data Forms that allows authenticated attack

CVE-2021-31585 MEDIUM
6.7 Jun 23

Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH pass

CVE-2026-23635 MEDIUM
6.5 Mar 25

Kiteworks Secure Data Forms prior to version 9.2.1 contains a misconfiguration of security attributes that allows unprot

CVE-2026-28271 MEDIUM
6.5 Feb 27

Kiteworks versions prior to 9.2.0 contain a DNS rebinding vulnerability that allows authenticated administrators to circ

CVE-2026-24753 MEDIUM
6.5 Jun 01

Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms allows authenticated low-privileged users to modi

CVE-2026-23638 MEDIUM
6.5 Jun 01

Insecure Direct Object Reference in Kiteworks Secure Data Forms (all versions prior to 9.3.0) allows any authenticated l

Share

CVE-2026-28270 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy