PT-2026-103530

CVE-2026-102092

Published

2026-09-30

Updated

2026-10-01

Description by

CVSS 3.1

8.7

High

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0

Description An authenticated user can store crafted content that executes arbitrary JavaScript in another user's authenticated session during the preview of shared content. This Stored Cross-site Scripting (XSS) issue may result in session compromise and account takeover.

Recommendations Update Kiteworks Core to version 9.5.0 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration