CVE-2026-102100: Kiteworks Core stored XSS
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Coreto a version that resolves this vulnerability.Fixed in 9.5.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated Kiteworks Core user can submit malicious content. Exploitation succeeds only when another user views that attacker-supplied content.
Which users are most at risk if malicious content is viewed?
Any user who views the content may have arbitrary JavaScript executed in their authenticated session. The impact may include actions performed as that user and potential account takeover, including for higher-privileged users.
What versions are affected?
Kiteworks Core versions before 9.5.0 are affected. Version 9.5.0 is identified as the fixed version boundary.