CVE-2026-105987: Stored XSS in KGS Software tia Viewer
KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker can inject arbitrary JavaScript payload into a stickynote annotation. When any user opens the document, the viewer renders the annotation and the browser executes the payload. This may lead to compromising the user's session. This issue has been fixed in version 1.2.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KGS Software tia Viewerto a version that resolves this vulnerability.Fixed in 1.2.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to submit a stickynote annotation through the annotation API. The payload executes when another user opens the affected document in the viewer.
What is the impact on users who open a malicious document?
The injected JavaScript runs in the browser when the viewer renders the stickynote annotation. This may allow compromise of the viewing user's session.
Which version resolves the vulnerability?
The issue is fixed in tia Viewer version 1.2.8.