CVE-2026-102092: Kiteworks Core stored XSS
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Coreto a version that resolves this vulnerability.Fixed in 9.5.0
Event History
Frequently Asked Questions
Which users are at risk from exploitation?
Authenticated users who preview shared content crafted by another authenticated user are at risk. Successful exploitation may allow JavaScript to run in the viewer’s authenticated session, potentially resulting in session compromise and account takeover.
What does an attacker need to exploit this issue?
The attacker needs an authenticated Kiteworks Core account and must be able to store crafted content that will be previewed by another authenticated user. Exploitation also requires the target user to preview that shared content.
Which versions require remediation?
Kiteworks Core versions before 9.5.0 are affected. Upgrade to version 9.5.0 or later.