CVE-2026-28270: medium-severity vulnerability in kiteworks security-advisories
Kiteworks Core has an Unrestricted Upload of File with Dangerous Type
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Kiteworks allows administrators to upload files without checking their type or safety, letting them add dangerous files to the system. This matters because it could let attackers store harmful content on the network.
CWE-434 vulnerability in Kiteworks prior to v9.2.0 permits unrestricted file uploads due to insufficient type validation on administrator-accessible endpoints. An authenticated malicious admin can upload arbitrary file types, potentially enabling code execution or data exfiltration depending on how uploaded files are processed. Fixed in version 9.2.0.
In the same product, most dangerous first.