CVE-2026-102100

8.7 Élevée

Publiée le 30/09/2026 à 23:16 · Modifiée le 07/10/2026 à 18:17 · Analysée par le NVD · Source : 9119a7d8-5eab-497f-8521-727c672e3725

Description

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.

Traduire en français

Produits concernés

Kiteworks Core
Accellion kiteworks

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.7 Élevée	9119a7d8-5eab-497f-8521-727c672e3725	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vr65-9jwc-jgjx Vendor Advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json Broken Link

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories