PT-2026-103538

CVE-2026-102100

Published

2026-09-30

Updated

2026-10-07

Description by

CVSS 3.1

8.7

High

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0

Description A stored cross-site scripting (XSS) weakness allows an authenticated user to submit content that executes arbitrary JavaScript in the session of another user who views that content. This can be used to perform actions on behalf of the victim and may lead to account takeover, including accounts with higher privileges.

Recommendations Update Kiteworks Core to version 9.5.0 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration