CVE-2026-102100 in Kiteworks
Summary
by MITRE • 10/01/2026
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Kiteworks Core prior to version 9.5.0 represents a significant security risk classified as Stored Cross-Site Scripting, commonly referred to as Persistent XSS or Type-1 XSS. This flaw resides within the application's input validation and output encoding mechanisms, specifically failing to properly sanitize user-supplied data before storing it in the backend database or content repository. Unlike reflected XSS attacks that require immediate interaction with a malicious link, stored vulnerabilities persist on the server side, meaning the malicious payload is saved as part of legitimate-looking content such as documents, comments, or profile information. This persistence ensures that every time an authorized user accesses this compromised data, the browser interprets and executes the embedded script within the context of the victim's active session with Kiteworks Core.
From a technical perspective, the core issue stems from insufficient validation of special characters and scripting tags during the ingestion phase of content processing. When an authenticated attacker submits malicious JavaScript code disguised as valid text or metadata, the application accepts this input without applying rigorous encoding rules such as HTML entity encoding for output contexts. Consequently, when another user views the affected file or page, their browser renders the script directly into the Document Object Model. Because Kiteworks Core is a platform handling sensitive enterprise data and facilitating collaboration among users with varying privilege levels, the execution of arbitrary JavaScript occurs within an authenticated session context. This allows the attacker to access cookies, session tokens, and other authentication credentials stored in the client-side environment, effectively bypassing standard security controls that rely on browser same-origin policies for protection against cross-site attacks.
The operational impact of this vulnerability is severe due to its potential for account takeover and lateral movement within an organization's digital ecosystem. An attacker can leverage the executed JavaScript to perform actions on behalf of the victim user without their knowledge or consent. This includes but is not limited to exfiltrating sensitive documents, modifying existing content, sending malicious emails through integrated communication tools, or changing security settings such as two-factor authentication configurations. If a higher-privileged user views the compromised content, the attacker gains elevated access rights, potentially allowing them to escalate privileges further and compromise critical infrastructure components managed by that account. The requirement for victim interaction is mitigated in enterprise environments where documents are frequently previewed, shared via links, or automatically synced across devices, increasing the likelihood of successful exploitation.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. Furthermore, it maps to several tactics within the MITRE ATT&CK framework for enterprise environments. Specifically, it falls under Initial Access via Spearphishing Attachment or Valid Accounts if used in conjunction with social engineering, and Execution through Browser Native Features such as JavaScript execution. The persistence of the payload also relates to Persistence mechanisms where malicious scripts remain active on the server side until manually removed by an administrator. Understanding these mappings is crucial for security teams to contextualize the risk within broader threat intelligence models and compliance reporting requirements.
To mitigate this vulnerability, organizations must immediately upgrade Kiteworks Core to version 9.5.0 or later, as specified in the vendor's security advisory. This update includes patches that enforce strict input validation and output encoding protocols, ensuring that any user-supplied data is treated as plain text rather than executable code when rendered in web browsers. In addition to applying the patch, administrators should implement Web Application Firewall rules that detect and block common XSS payloads such as script tags, event handlers like onerror or onload, and encoded variants of these strings. Regular security audits and penetration testing focused on input validation weaknesses are recommended to identify similar flaws across other modules within the application suite. Furthermore, enabling Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts can be loaded and executed, thereby limiting the impact even if a vulnerability is present in future versions.