CVE-2026-102109: Kiteworks Secure Data Forms SQL injection
A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to deployments where a specific optional feature is in use.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only deployments using the affected optional feature are in scope. The issue is in Kiteworks Secure Data Forms, and the provided information does not identify the feature by name.
What does an attacker need to exploit it?
An attacker needs an authenticated session and must be able to influence the relevant value derived from their stored account data. No user interaction is required.
What is the likely impact of successful exploitation?
Successful exploitation could allow access to sensitive data and limited modification of data. The supplied severity vector indicates no availability impact.