CVE-2026-24782: Kiteworks Secure Data Forms has a SQL Injection vulnerability
Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Secure Data Formsto a version that resolves this vulnerability.Fixed in 9.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24782?
The severity of CVE-2026-24782 is classified as high with a CVSS score of 8.8.
How do I fix CVE-2026-24782?
To fix CVE-2026-24782, upgrade to Kiteworks Secure Data Forms version 9.3.0 or later.
What type of vulnerability is CVE-2026-24782?
CVE-2026-24782 is a SQL Injection vulnerability affecting Kiteworks Secure Data Forms.
Who can exploit CVE-2026-24782?
CVE-2026-24782 can be exploited by an authenticated attacker with the FormBuilder role.
What can an attacker do with CVE-2026-24782?
An attacker can retrieve information or modify other users' form definitions and some global configurations.