CVE-2026-102137: Kiteworks Core Unrestricted Upload of File with Dangerous Type

Published Sep 30, 2026

Updated

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file.

Affected Software

1 affected component

Kiteworks Kiteworks Core

Event History

Sep 30, 2026

CVE Published

via MITRE·08:11 PM

Data Sourced

via MITRE·08:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires an authenticated administrator. An unauthenticated user is not described as able to use the affected administrative upload path.

Does uploading a dangerous file lead directly to code execution?

No. The issue allows dangerous content to be stored on the appliance, but code execution would require a separate vulnerability to execute the uploaded file.

What security impact is described if the issue is exploited?

The supplied severity vector indicates low confidentiality, integrity, and availability impact. Exploitation also has high attack complexity and requires high privileges.

CVE-2026-102137: Kiteworks Core Unrestricted Upload of File with Dangerous Type

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Does uploading a dangerous file lead directly to code execution?

What security impact is described if the issue is exploited?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does uploading a dangerous file lead directly to code execution?

What security impact is described if the issue is exploited?