CVE-2026-102091: Kiteworks Secure Data Forms server-side request forgery
Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Secure Data Formsto a version that resolves this vulnerability.Fixed in 9.5.0
Event History
Frequently Asked Questions
Which deployments are affected?
Kiteworks Secure Data Forms versions before 9.5.0 are affected. The provided information does not identify any configuration prerequisite or deployment limitation.
Does an attacker need an account or user interaction to exploit this issue?
No. The vulnerability is described as exploitable remotely by an unauthenticated attacker, with no user interaction required.
What could an attacker access through exploitation?
An attacker could cause the server to make arbitrary outbound network requests and read the responses. This could expose internal-only services or other resources protected by network restrictions.