CVE-2026-102137

Published: Sep 30, 2026Modified: Oct 13, 2026

4.1

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Exploitability: 0.7 / Impact: 3.4

Source: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)

Description

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file.

Affected (1)

Products: Accellion: Kiteworks

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Accellion Kiteworks	version < 9.5.1

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m6cv-4pjv-7435

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Vendor Advisory

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Broken Link

Timeline

No history available yet.