The vulnerability is a missing validation that allows a form manager to upload files of any type, including dangerous executables, to Kiteworks Secure Data Forms. Because the upload control accepts any MIME type or file extension, an attacker could place a malicious script or binary as part of a form's resources. This increases the risk that the uploaded content could be executed by the system or used by subsequent users, leading to compromise of confidentiality, integrity, or availability. The weakness is identified as CWE-434, an unrestricted upload of files with dangerous types.

Kiteworks Secure Data Forms from Accellion is affected. Any deployment of the product that is running a version earlier than 9.2.1 is susceptible, including versions 9.0.x, 9.1.x, and other earlier releases. The advisory specifically applies to form managers who can configure forms within the application.

The CVSS score of 5.5 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication as a form manager and depends on the ability to upload a file that the system later processes or executes. Because the attack vector is restricted to users with management rights, the attack surface is limited, but if compromised credentials are involved, the risk of code execution or data exfiltration is significant.