Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Kiteworks — Vulnerabilities & Security Advisories 85

Browse all 85 CVE security advisories affecting Kiteworks. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Kiteworks provides a secure file transfer and content collaboration platform for enterprises handling sensitive data. Historically, vulnerabilities have included remote code execution, cross-site scripting, and privilege escalation flaws, often stemming from input validation failures and access control weaknesses. The platform has faced multiple security incidents, including a 2023 breach exposing customer data due to an unpatched vulnerability. With 15 CVEs recorded, Kiteworks has demonstrated recurring issues in secure coding practices, particularly in web application components and authentication mechanisms. Organizations implementing Kiteworks should prioritize timely patching and harden configurations against common attack vectors targeting enterprise file sharing systems.

CVE ID Title CVSS Severity Published
CVE-2026-102089 Kiteworks Email Protection Gateway path traversal — Email Protection Gateway CWE-22 7.2 High 2026-09-30
CVE-2026-24782 Kiteworks Secure Data Forms has a SQL Injection vulnerability — Secure Data Forms CWE-89 7.6 High 2026-06-01
CVE-2026-24761 Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key — Secure Data Forms CWE-639 3.7 Low 2026-06-01
CVE-2026-24756 Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key — Secure Data Forms CWE-639 4.3 Medium 2026-06-01
CVE-2026-24755 Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key — Secure Data Forms CWE-639 5.4 Medium 2026-06-01
CVE-2026-24754 Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting — security-advisories CWE-79 5.4 Medium 2026-06-01
CVE-2026-24753 Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key — Secure Data Forms CWE-639 6.5 Medium 2026-06-01
CVE-2026-24752 Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting — Secure Data Forms CWE-79 8.2 High 2026-06-01
CVE-2026-24751 Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting — Secure Data Forms CWE-79 8.2 High 2026-06-01
CVE-2026-23638 Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key — Secure Data Forms CWE-639 6.5 Medium 2026-06-01
CVE-2026-29092 Kiteworks Email Protection Gateway has an Insufficient Session Expiration — Kiteworks Email Protection Gateway CWE-613 4.9 Medium 2026-03-25
CVE-2026-23636 Kiteworks Secure Data Forms is vulnerable to an Unrestricted Upload of File with Dangerous Type — Secure Data Forms CWE-434 5.5 Medium 2026-03-25
CVE-2026-23635 Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentials — Secure Data Forms CWE-523 6.5 Medium 2026-03-25
CVE-2026-24750 Kiteworks Secure Data Forms vulnerable to Cross-site Scripting — Secure Data Forms CWE-79 7.6 High 2026-03-25
CVE-2026-23514 Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Management — core CWE-282 8.8 High 2026-03-25
CVE-2026-28272 Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability — security-advisories CWE-79 8.1 High 2026-02-27
CVE-2026-28271 Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF) — security-advisories CWE-350 6.5 Medium 2026-02-27
CVE-2026-28270 Kiteworks Core has an Unrestricted Upload of File with Dangerous Type — security-advisories CWE-434 4.9 Medium 2026-02-27
CVE-2026-28269 Kiteworks Core has an OS Command Injection — security-advisories CWE-78 5.9 Medium 2026-02-26
CVE-2025-53939 Kiteworks Core is vulnerable to Improper Input Validation — security-advisories CWE-20 6.3 Medium 2025-11-29
CVE-2025-53900 Kiteworks MFT has a Privilege Defined With Unsafe Actions — security-advisories CWE-267 6.5 Medium 2025-11-29
CVE-2025-53899 Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channel — security-advisories CWE-941 7.2 High 2025-11-29
CVE-2025-53897 Kiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability — security-advisories CWE-352 6.8 Medium 2025-11-29
CVE-2025-53896 Kiteworks MFT is vulnerable to Insufficient Session Expiration — security-advisories CWE-613 7.1 High 2025-11-29
CVE-2023-7273 Cross Site Request Forgery in Kiteworks OwnCloud — OwnCloud CWE-352 6.8 Medium 2024-10-01

This page lists every published CVE security advisory associated with Kiteworks. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.