Kiteworks Core: Stored Cross-Site Scripting
Summary
Kiteworks Core before 9.5.0 contains a stored cross-site scripting (XSS) flaw (CWE-79). An authenticated user can submit content that executes arbitrary JavaScript in the session of another user who views it. This can be used to perform actions as the victim and may allow account takeover, including of higher-privileged users. Exploitation requires that a victim views the attacker-supplied content.
Affected
- Kiteworks Core versions before 9.5.0
Fixed in
- Kiteworks Core 9.5.0 or later
- 9.5.1 is the current release
Workaround
Unknown. No vendor workaround was identified; upgrading is the remedy.
Exploitation
- No evidence of exploitation in the wild was found.
- CISA SSVC assessment: exploitation none, not automatable.
- A public proof of concept was reported by a third party but could not be verified.
Our recommendation
- Upgrade Kiteworks Core to 9.5.1 or later as a priority.
- Review which accounts can submit content that other users view, and limit accounts to those needed.
- Reduce the number of users with administrator rights.
- Check administrator accounts and recent activity for unexpected changes.
- Confirm the exposure of your Kiteworks instance, especially for self-managed installations.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vr65-9jwc-jgjx github.com
- CISA CSAF VA-26-274-01 raw.githubusercontent.com
- OpenCVE CVE-2026-102100 app.opencve.io
- VulDB CVE-2026-102100 vuldb.com
- HOL Guard CVE-2026-102100 hol.org
- Canadian Centre for Cyber Security advisory AV26-988 www.cyber.gc.ca
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:28.
Original description (NVD)
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.