CVE-2026-102140

Published: Sep 30, 2026Modified: Oct 13, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.2 / Impact: 3.6

Source: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)

Description

An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the imported data.

Affected (1)

Products: Accellion: Kiteworks

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Accellion Kiteworks	version < 9.5.1

Related CWEs

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (2)

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wfxj-p5jc-jqjw

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Vendor Advisory

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Broken Link

Timeline

No history available yet.