CVE-2026-102092
CVE-2026-102092
8.7
HighPublished:
Last updated:
Source:9119a7d8-5eab-497f-8521-727c672e3725
Analyzed
Weakness (CWE)
CVSS Vector
v3.1- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Description
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.
References
9119a7d8-5eab-497f-8521-727c672e3725
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mhw9-vrqq-m4349119a7d8-5eab-497f-8521-727c672e3725
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json