CVE-2026-28270

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-v8x9-vwg6-cj45	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-27 21:16

Updated : 2026-03-04 19:50

NVD link : CVE-2026-28270

Mitre link : CVE-2026-28270

CVE.ORG link : CVE-2026-28270

JSON object : View

Products Affected

accellion

kiteworks

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2026-28270", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2026-02-27T21:16:18.397", "references": [{"url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-v8x9-vwg6-cj45", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue."}, {"lang": "es", "value": "Kiteworks es una red de datos privada (PDN). Antes de la versi\u00f3n 9.2.0, una vulnerabilidad en la configuraci\u00f3n de Kiteworks permite la carga de archivos arbitrarios sin la validaci\u00f3n adecuada. Administradores maliciosos podr\u00edan explotar esto para cargar tipos de archivos no autorizados al sistema. La versi\u00f3n 9.2.0 contiene un parche para el problema."}], "lastModified": "2026-03-04T19:50:06.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B494C8D4-2D4B-4F5E-99C1-4CCE8DF6C911", "versionEndExcluding": "9.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}