CVE-2026-102147
CVE-2026-102147
9.3
CriticalPublished:
Last updated:
Source:9119a7d8-5eab-497f-8521-727c672e3725
Analyzed
Weakness (CWE)
CVSS Vector
v3.1- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Description
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.
References
9119a7d8-5eab-497f-8521-727c672e3725
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93r9119a7d8-5eab-497f-8521-727c672e3725
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json