CVE-2026-102100: Kiteworks Core stored XSS

Q: Who can exploit this vulnerability?

An authenticated Kiteworks Core user can submit malicious content. Exploitation succeeds only when another user views that attacker-supplied content.

Q: Which users are most at risk if malicious content is viewed?

Any user who views the content may have arbitrary JavaScript executed in their authenticated session. The impact may include actions performed as that user and potential account takeover, including for higher-privileged users.

Q: What versions are affected?

Kiteworks Core versions before 9.5.0 are affected. Version 9.5.0 is identified as the fixed version boundary.

Published Sep 30, 2026

Updated

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.

Affected Software

1 affected component

Kiteworks Kiteworks Core<9.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kiteworks Core to a version that resolves this vulnerability.
Fixed in 9.5.0

Event History

Sep 30, 2026

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An authenticated Kiteworks Core user can submit malicious content. Exploitation succeeds only when another user views that attacker-supplied content.

Which users are most at risk if malicious content is viewed?

Any user who views the content may have arbitrary JavaScript executed in their authenticated session. The impact may include actions performed as that user and potential account takeover, including for higher-privileged users.

What versions are affected?

Kiteworks Core versions before 9.5.0 are affected. Version 9.5.0 is identified as the fixed version boundary.

CVE-2026-102100: Kiteworks Core stored XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Which users are most at risk if malicious content is viewed?

What versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Which users are most at risk if malicious content is viewed?

What versions are affected?