CVE-2026-102140: Kiteworks Core Insufficient Verification of Data Authenticity
An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the imported data.
Affected Software
Event History
Frequently Asked Questions
Can an unauthenticated or low-privileged user exploit this issue?
No. Exploitation requires authenticated administrator privileges, so unauthenticated and lower-privileged users are not identified as able to initiate the affected administrative import.
Does exploitation require user interaction or a complex attack setup?
No user interaction is required, and the attack complexity is rated low. An administrator would need to submit an import file with a valid header but unverified or forged remaining content.
What is the expected security impact?
The impact is limited to integrity of imported data. The provided severity vector identifies no confidentiality or availability impact.