Threat database

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.

Kiteworks Secure Data Forms versions prior to 9.3.0 contain multiple SQL Injection vulnerabilities. These can be exploited by an authenticated attacker with the FormBuilder role to access or modify other users' form definitions and some global configuration parameters. The vulnerability is addressed in version 9.3.0 and later.

An Insecure Direct Object Reference (IDOR) vulnerability exists in kiteworks Secure Data Forms prior to version 9.3.0. This vulnerability allows an authenticated user to access metadata of resources owned by other users due to insufficient authorization checks. The issue is resolved by upgrading to version 9.3.0 or later.

An authorization bypass vulnerability (CWE-639) exists in Kiteworks Secure Data Forms prior to version 9.3.0. This Insecure Direct Object Reference (IDOR) flaw allows an authenticated user to modify resources owned by other users due to insufficient authorization checks. The vulnerability has a medium severity with a CVSS score of 4.3. Upgrading to version 9.3.0 or later addresses this issue.

An Insecure Direct Object Reference (IDOR) vulnerability exists in kiteworks Secure Data Forms prior to version 9.3.0. This vulnerability allows an authenticated user to modify permissions on resources owned by other users due to insufficient authorization checks. The issue is resolved by upgrading to version 9.3.0 or later.

Kiteworks Secure Data Forms versions prior to 9.3.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows an authenticated attacker to inject and execute arbitrary JavaScript code in other users' sessions. The vulnerability is fixed in version 9.3.0 and later.

Kiteworks Secure Data Forms prior to version 9.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to modify resources owned by other users due to insufficient authorization checks. This vulnerability is addressed in version 9.3.0 and later.

A reflected cross-site scripting (XSS) vulnerability exists in kiteworks Secure Data Forms prior to version 9.3.0. This vulnerability allows an external attacker to trick a user into executing arbitrary JavaScript code. The issue is fixed in version 9.3.0 and later.

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

An authorization bypass vulnerability (CWE-639) exists in Kiteworks Secure Data Forms versions prior to 9.3.0. This Insecure Direct Object Reference (IDOR) flaw allows an authenticated attacker to manipulate approval flow configurations of forms owned by other users due to insufficient authorization checks. The vulnerability has a CVSS score of 6.5 (medium severity). No known exploits are reported in the wild. Users should upgrade to version 9.3.0 or later to address this issue.

Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway session management allows blocked users to maintain active sessions after their account is disabled. This could allow unauthorized access to continue until the session naturally expires. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

CVE-2026-23636 is a medium severity vulnerability in Kiteworks Secure Data Forms prior to version 9.2.1. It involves an unrestricted upload of files with dangerous types due to missing validation, which could be exploited by a form manager. This vulnerability can lead to integrity impact but does not affect confidentiality. A patch is available in Kiteworks version 9.2.1 and later.

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potentially lead to Unprotected Transport of Credentials under certain circumstances. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control vulnerability that allows authenticated users to access unauthorized content. Upgrade Kiteworks Core to version 9.2.2 or later to receive a patch.

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue.

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue.

Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.

Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly elevate another user's permissions on the share. This issue has been patched in version 9.1.0.