CVE-2026-102092 in Kiteworks
Summary
by MITRE • 10/01/2026
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Kiteworks Core versions prior to 9.5.0 represents a significant security risk classified as Stored Cross-site Scripting, commonly referred to as persistent XSS. Unlike reflected XSS attacks where malicious scripts are executed immediately within the context of a user's browser session through a crafted link, stored vulnerabilities involve the injection and subsequent storage of malicious code on the target server or application database. In this specific instance, an authenticated attacker can exploit the functionality related to previewing shared content by injecting specially crafted input that contains executable JavaScript payloads. The critical flaw lies in the insufficient sanitization or validation of user-supplied data before it is rendered back to other users who access these shared files. When a victim views the compromised file within their browser, the malicious script executes automatically because the application fails to properly encode special characters such as angle brackets and quotes that are essential for breaking out of HTML contexts.
From an operational perspective, this vulnerability allows an authenticated user with write or upload privileges to compromise other users who have read access to the same shared content. The execution context is particularly dangerous because it occurs within a trusted domain where the victim holds valid authentication credentials. This environment grants the malicious script full access to session cookies, local storage data, and potentially sensitive documents being viewed at that moment. An attacker can leverage this capability to perform actions on behalf of the victim without their knowledge or consent. Common exploitation techniques include stealing session tokens to hijack accounts, redirecting users to phishing sites designed to capture credentials, or manipulating the user interface to trick victims into performing unintended administrative actions. This directly leads to unauthorized account takeover and potential exposure of confidential enterprise data stored within the Kiteworks platform.
The technical nature of this flaw aligns with CWE-79, which defines Improper Neutralization of Input During Web Page Generation as Cross-site Scripting. The root cause is typically a failure in input validation on the server side or inadequate output encoding when rendering user-generated content to the client browser. By failing to distinguish between executable script code and safe text data during the preview generation process, the application violates fundamental web security principles regarding context-aware escaping. This oversight enables the injection of arbitrary JavaScript that bypasses same-origin policy protections because it is served from a trusted source domain. The persistence of this payload means that every subsequent user accessing the shared content becomes a potential victim until the malicious entry is manually removed or the vulnerability is patched, creating an ongoing threat vector within the organization's collaboration workflow.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is to upgrade Kiteworks Core to version 9.5.0 or later where this specific input validation flaw has been addressed by developers through enhanced sanitization routines. In addition to patching, organizations should implement strict Content Security Policy headers that restrict the execution of inline scripts unless explicitly whitelisted, thereby neutralizing many XSS attacks even if they occur. Input validation mechanisms should be strengthened on both client and server sides to ensure that only expected character sets are accepted in fields related to file metadata or shared content descriptions. Furthermore, adopting a defense-in-depth approach by deploying Web Application Firewalls can help detect and block attempts to inject malicious payloads before they reach the application logic. Regular security audits and penetration testing focused on stored XSS vectors will also help identify similar weaknesses across other modules of the platform that handle user-generated content.