CVE-2026-24751: Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Synopsis

A reflected cross-site scripting (XSS) vulnerability affects Kiteworks Secure Data Forms in versions prior to 9.3.0. The flaw is reachable over the network without any authentication, but requires a victim to follow a crafted link or otherwise interact with attacker-controlled input in their browser. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session, enabling session hijacking, credential theft, or malicious actions performed on the victim's behalf. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the Kiteworks service via standard HTTP/S to deliver a malicious payload.

• AuthenticationNot required

  No account or credentials are needed; the attacker crafts a malicious URL and delivers it to a target without authenticating to the application.

• Victim interactionRequired

  The victim must follow a crafted link or otherwise trigger the reflected payload in their browser, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning no special conditions, race windows, or environmental prerequisites are required for the exploit to succeed reliably.

Blast Radius

• The attacker executes arbitrary JavaScript inside the victim's authenticated browser session, giving access to session cookies and stored tokens.
• Sensitive data visible to the victim in the Kiteworks interface, including file metadata and form contents, can be read and exfiltrated.
• The attacker can perform actions within the application on the victim's behalf, such as submitting forms or initiating file transfers.
• Integrity impact is limited but present: attacker-controlled script can modify page content displayed to the victim in real time.