CVE-2026-24754 — Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

CVE-2026-24754

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting PUBLISHED

Description (CNA)

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a stored XSS vulnerability in Kiteworks Secure Data Forms could allow an authenticated attacker to execute arbitrary JavaScript code in other users' sessions. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

Affected (CNA)

Vendor / product	Versions
kiteworks / security-advisories	affected < 9.3.0

CWE

CWE-79

References

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-gxvv-hwgc-w7gh

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.