Kiteworks Core: Stored cross-site scripting when previewing shared content

Summary

Kiteworks Core before version 9.5.0 contains a stored cross-site scripting (XSS) flaw. An authenticated user can store crafted content that runs arbitrary JavaScript in another user's authenticated session when that user previews the shared content. This can lead to session compromise and account takeover, and CISA rates the CVSS 3.1 base score at 8.7 (High).

Affected

• Kiteworks Core versions before 9.5.0

Fixed in

• Kiteworks Core 9.5.0 (according to the vendor advisory GHSA-mhw9-vrqq-m434)

Workaround

• No vendor-documented workaround known.
• Interim measures until patched: limit who can create accounts and share content, restrict external sharing, and limit administrative sessions to trusted networks.

Exploitation

• CISA SSVC: exploitation none, automatable no.
• No public proof of concept or in-the-wild exploitation found in our research.

Our recommendation

• Inventory all Kiteworks Core instances and their versions at each client.
• Upgrade affected instances to Kiteworks Core 9.5.0 or later, and verify the fixed version against the vendor advisory.
• Until patched, restrict content sharing and external guest access, and review recently shared content for script-like markup.
• Check whether the instances are internet-facing and whether administrators preview untrusted shared content.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-mhw9-vrqq-m434 (Kiteworks) github.com
• CISA CSAF advisory VA-26-274-01 raw.githubusercontent.com
• OpenCVE record CVE-2026-102092 app.opencve.io
• Threatint record CVE-2026-102092 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:30.