CVE-2026-24750: Kiteworks Stored XSS Vulnerability

CVE-2026-24750 Overview

CVE-2026-24750 is a Stored Cross-Site Scripting (XSS) vulnerability in Kiteworks Secure Data Forms prior to version 9.2.1. Kiteworks is a private data network (PDN) platform designed for secure file sharing and data management. This vulnerability allows an authenticated attacker to exploit an Improper Neutralization of Input During Web Page Generation when modifying forms, enabling the injection of malicious scripts that persist and execute when other users view the compromised forms.

Critical Impact

Authenticated attackers can inject persistent malicious scripts into forms, potentially leading to session hijacking, credential theft, and unauthorized actions performed on behalf of other users who interact with the compromised forms.

Affected Products

• Kiteworks Secure Data Forms versions prior to 9.2.1
• Kiteworks Private Data Network (PDN) deployments using vulnerable Secure Data Forms component

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-24750 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-24750

Vulnerability Analysis

This Stored XSS vulnerability (CWE-79) occurs due to improper neutralization of user-supplied input during web page generation within the Kiteworks Secure Data Forms feature. When an authenticated user modifies form content, the application fails to properly sanitize or encode the input before storing it in the database and subsequently rendering it in users' browsers.

Unlike reflected XSS which requires tricking users into clicking malicious links, stored XSS persists within the application, automatically executing whenever any user views the affected form. This makes it particularly dangerous in enterprise environments where forms may be accessed by numerous users across the organization.

The vulnerability requires authentication to exploit, meaning attackers must first have valid credentials to the Kiteworks platform. However, once exploited, the malicious payload affects all users who subsequently view or interact with the modified form, potentially including administrators with elevated privileges.

Root Cause

The root cause is insufficient input validation and output encoding in the Kiteworks Secure Data Forms module. When form content is modified, the application stores user-controlled data without proper sanitization. Subsequently, when rendering these forms, the application fails to apply appropriate output encoding, allowing embedded JavaScript or HTML to execute in the context of other users' browser sessions.

Attack Vector

The attack is conducted over the network and requires the attacker to have low-privilege authenticated access to the Kiteworks platform. The attack follows this general pattern:

1. The attacker authenticates to the Kiteworks platform with valid credentials
2. The attacker navigates to the Secure Data Forms functionality
3. When modifying or creating a form, the attacker injects malicious script content into vulnerable form fields
4. The malicious payload is stored in the application database
5. When other users (including administrators) view the form, the malicious script executes in their browser context
6. The script can steal session tokens, perform actions as the victim user, or redirect to phishing sites

The vulnerability requires user interaction—specifically, a victim must view the compromised form for the attack to succeed. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-24750

Indicators of Compromise

• Unusual JavaScript or HTML tags present in form field data within the Kiteworks database
• Unexpected network requests originating from user sessions to external domains
• Reports from users about strange behavior or redirects when accessing specific forms
• Audit log entries showing form modifications with suspicious content patterns

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS payloads in form submissions
• Deploy Content Security Policy (CSP) headers to restrict inline script execution and report violations
• Monitor application logs for form modification events containing script tags or event handlers
• Utilize SentinelOne's behavioral analysis to detect anomalous browser activity associated with XSS exploitation

Monitoring Recommendations

• Enable detailed audit logging for all form creation and modification activities in Kiteworks
• Configure alerting for CSP violation reports indicating attempted script injection
• Monitor for unusual session activity patterns that may indicate session hijacking post-exploitation
• Review form content periodically for suspicious embedded scripts or HTML elements

How to Mitigate CVE-2026-24750

Immediate Actions Required

• Upgrade Kiteworks to version 9.2.1 or later immediately to receive the security patch
• Audit existing forms for any suspicious content or embedded scripts that may indicate prior exploitation
• Review user access logs for any unauthorized form modifications
• Implement or strengthen Content Security Policy headers as a defense-in-depth measure

Patch Information

Kiteworks has released version 9.2.1 which addresses this vulnerability. Organizations should upgrade to this version or later as soon as possible. The patch implements proper input validation and output encoding for form content within the Secure Data Forms feature. For patch details and upgrade instructions, consult the GitHub Security Advisory.

Workarounds

• Restrict form modification privileges to only trusted administrators until patching is complete
• Implement strict Content Security Policy headers to prevent inline script execution
• Deploy a Web Application Firewall with XSS protection rules in front of the Kiteworks deployment
• Consider temporarily disabling the Secure Data Forms feature if not business-critical until the patch can be applied

# Example Content Security Policy header configuration for defense-in-depth
# Add to web server configuration (Apache example)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self';"

# For nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self';";