CVE-2026-23636 MEDIUM

CVE-2026-23636: Kiteworks Secure Data Forms is vulnerable to an Unrestricted Upload of File with Dangerous Type

Vendor Kiteworks

Product Secure Data Forms

Weakness CWE-434 · Unrestricted file upload

Published March 25, 2026

Last update March 27, 2026

View on NVD All CVEs

CVSS base score

5.5/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

What the vulnerability does

01Description

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, the manager of a form could potentially exploit an Unrestricted Upload of File with Dangerous Type due to a missing validation. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

Key dates

02Disclosure timeline

March 25, 2026 CVE published

March 27, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-23636 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2024-5441 Modern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2025-15360 newbee-mall-plus Product Information Edit UploadController.java upload unrestricted upload CVE-2025-6423 BeeTeam368 Extensions <= 2.3.5 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2023-47846 WordPress WP Githuber MD plugin <= 1.16.2 - Arbitrary File Upload vulnerability CVE-2025-4468 SourceCodester Online Student Clearance System edit-photo.php unrestricted upload