{"id":"CVE-2026-102147","published":"2026-09-30T21:17:03.633","lastModified":"2026-10-01T14:17:19.027","description":"A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93r","tags":[]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","tags":[]}],"exploitRefs":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93r","tags":[]}],"hasPoc":true,"ai":{"summary":"A stored cross-site scripting (XSS) vulnerability in Kiteworks Core allows unauthenticated attackers to inject malicious JavaScript, potentially gaining full administrative control.","exploitability":"Exploitation is relatively straightforward for an attacker who can control the content stored, requiring only that an administrator view the crafted page.","blast_radius":"If exploited, the attacker could gain full administrative control, including the ability to create new administrative accounts, severely impacting system security.","remediation":"Upgrade to the fixed version 2.590 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","admin-bypass"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:46:11.406Z"}}