CVE-2026-102092: Kiteworks Core stored XSS

Q: Which users are at risk from exploitation?

Authenticated users who preview shared content crafted by another authenticated user are at risk. Successful exploitation may allow JavaScript to run in the viewer’s authenticated session, potentially resulting in session compromise and account takeover.

Q: What does an attacker need to exploit this issue?

The attacker needs an authenticated Kiteworks Core account and must be able to store crafted content that will be previewed by another authenticated user. Exploitation also requires the target user to preview that shared content.

Q: Which versions require remediation?

Kiteworks Core versions before 9.5.0 are affected. Upgrade to version 9.5.0 or later.

Published Sep 30, 2026

Updated

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.

Affected Software

1 affected component

Kiteworks Core<9.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kiteworks Core to a version that resolves this vulnerability.
Fixed in 9.5.0

Event History

Sep 30, 2026

CVE Published

via MITRE·08:06 PM

Data Sourced

via MITRE·08:06 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users are at risk from exploitation?

Authenticated users who preview shared content crafted by another authenticated user are at risk. Successful exploitation may allow JavaScript to run in the viewer’s authenticated session, potentially resulting in session compromise and account takeover.

What does an attacker need to exploit this issue?

The attacker needs an authenticated Kiteworks Core account and must be able to store crafted content that will be previewed by another authenticated user. Exploitation also requires the target user to preview that shared content.

Which versions require remediation?

Kiteworks Core versions before 9.5.0 are affected. Upgrade to version 9.5.0 or later.

CVE-2026-102092: Kiteworks Core stored XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users are at risk from exploitation?

What does an attacker need to exploit this issue?

Which versions require remediation?

Company

Resources

Contact

Frequently Asked Questions

Which users are at risk from exploitation?

What does an attacker need to exploit this issue?

Which versions require remediation?