EUVD-2026-15541Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
Lifecycle Timeline
4DescriptionGitHub Advisory
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, the manager of a form could potentially exploit an Unrestricted Upload of File with Dangerous Type due to a missing validation. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
AnalysisAI
Kiteworks Secure Data Forms contains an unrestricted file upload vulnerability (CWE-434) that allows form managers to upload files with dangerous types due to missing input validation. An authenticated attacker with manager privileges can exploit this to upload malicious files, potentially leading to code execution or system compromise. The vulnerability affects all versions prior to 9.2.1, and a patch is available; no public exploit code has been confirmed, but the moderate CVSS score of 5.5 reflects the high integrity impact combined with the requirement for elevated privileges.
Technical ContextAI
The vulnerability resides in Kiteworks Secure Data Forms, a component of the Kiteworks Private Data Network (PDN) platform designed to facilitate secure data exchange. The root cause is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), a critical input validation flaw where the application fails to properly validate or restrict file types during upload operations. This validation gap exists in the form management functionality, specifically in code paths accessible to users with manager-level privileges. The lack of proper file type checking, MIME type validation, and execution prevention mechanisms allows dangerous file extensions or executable content to bypass security controls and be stored on the server.
RemediationAI
Immediately upgrade Kiteworks to version 9.2.1 or later, which contains the patch for this vulnerability. The vendor has provided the fix in the official release, and deployment should be prioritized given the file upload nature of the flaw. Until patching is completed, implement compensating controls by restricting form manager access to trusted administrators only, disabling upload functionality if not critical, and ensuring the upload directory is not executable by the web server (verify file permissions and web server configuration to prevent execution of uploaded files). Monitor upload activity logs for suspicious file types or patterns. Organizations unable to immediately patch should contact Kiteworks support for guidance on temporary mitigations specific to their deployment.
More in Secure Data Forms
View allReflected cross-site scripting in Kiteworks Secure Data Forms (versions prior to 9.3.0) allows remote unauthenticated at
Reflected cross-site scripting in Kiteworks Secure Data Forms prior to version 9.3.0 allows external attackers to execut
A stored cross-site scripting (XSS) vulnerability exists in Kiteworks Secure Data Forms that allows authenticated attack
SQL injection in Kiteworks Secure Data Forms before version 9.3.0 allows an authenticated attacker holding the FormBuild
Kiteworks Secure Data Forms prior to version 9.2.1 contains a misconfiguration of security attributes that allows unprot
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms allows authenticated low-privileged users to modi
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms exposes a permission-modification vector for any
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms prior to version 9.3.0 allows any authenticated l
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms prior to version 9.3.0 enables access to other us
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today