CVE-2026-24782: Kiteworks Secure Data Forms has a SQL Injection vulnerability

Synopsis

SQL injection in Kiteworks Secure Data Forms allows an authenticated attacker holding the FormBuilder role to manipulate SQL queries sent to the underlying database. The vulnerability is reachable over the network and requires no victim interaction, but does require a low-privilege account with the FormBuilder role. Successful exploitation lets the attacker read other users' form definitions and global configuration parameters, or overwrite them. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the Kiteworks service via HTTP/HTTPS.

• AuthenticationRequired

  The attacker must hold a valid account with the FormBuilder role; any account granted that role is sufficient.

• Victim interactionNot required

  No victim action is needed; the attacker sends crafted requests directly to the service.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental configuration.

Blast Radius

• Reads other users' form definitions, potentially exposing field layouts, validation rules, and any data embedded in form configurations.
• Reads global configuration parameters stored in the database, which may include application settings or integration credentials.
• Modifies other users' form definitions, allowing an attacker to alter form behavior or inject malicious field configurations.
• Modifies global configuration parameters, enabling persistent tampering with application-wide settings.