CVE-2026-102137: Kiteworks Core

Medium severity, CVSS 4.1. EPSS: 0.3% chance of exploitation in the next 30 days.

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file.

Affected products

• Kiteworks Core: before 9.5.1 (fixed in 9.5.1)

Published 2026-09-30. Last modified 2026-10-01.