CVE-2026-102147: Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker does not need authentication and can store crafted content through the vulnerable functionality. Exploitation requires an administrator to later view the affected page, causing the stored JavaScript to run in that administrator's authenticated session.
Who is exposed to account takeover?
Kiteworks Core administrators who view affected pages containing attacker-supplied stored content are directly exposed. A successful attack could give the attacker full administrative control, including the ability to create a new administrative account.