CVE-2026-102137: Kiteworks Core Unrestricted Upload of File with Dangerous Type
An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated administrator. An unauthenticated user is not described as able to use the affected administrative upload path.
Does uploading a dangerous file lead directly to code execution?
No. The issue allows dangerous content to be stored on the appliance, but code execution would require a separate vulnerability to execute the uploaded file.
What security impact is described if the issue is exploited?
The supplied severity vector indicates low confidentiality, integrity, and availability impact. Exploitation also has high attack complexity and requires high privileges.