CVE-2026-24754

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the Thank You Page configuration of Kiteworks Secure Data Forms prior to version 9.3.0. This flaw allows an authenticated attacker to inject arbitrary JavaScript code that can be executed in the sessions of other users [1].

Exploitation

An authenticated attacker can exploit this vulnerability by injecting malicious JavaScript code into the Thank You Page configuration. When another user views the affected page or interacts with the form, the injected script will execute within their session [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the context of another user's session. This can lead to session hijacking, data theft, or further malicious actions within the Kiteworks application, depending on the privileges of the targeted user [1].

Mitigation

Kiteworks has released version 9.3.0, which addresses this vulnerability. Users are advised to upgrade to version 9.3.0 or later to receive the patch [1].