# KGS Software tia Viewer Stored XSS Fixed

Published: 2026-10-27 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/2bfcf03a-a4be-552b-b622-06080d7fe558/kgs-software-tia-viewer-stored-xss-fixed

> A stored XSS flaw in KGS Software tia Viewer lets an authenticated attacker hijack user sessions via malicious annotations; patched in version 1.2.8.

CERT Polska coordinated disclosure of CVE-2026-105987, a stored cross-site scripting vulnerability in KGS Software's tia Viewer affecting all versions prior to 1.2.8. The flaw stems from improper input validation in the annotation API, allowing an authenticated attacker to inject arbitrary JavaScript into a stickynote annotation within a document. When another user subsequently opens the document, the viewer renders the malicious annotation and the browser executes the payload, potentially compromising that user's session.

The vulnerability requires the attacker to have authenticated access to inject the payload, limiting the attack to insiders or users with legitimate access who abuse annotation functionality to target other users of shared documents. There is no indication of active exploitation in the wild; this is a responsibly disclosed vulnerability reported by researcher Dawid Dudek (4c1d8urn) through CERT Polska's coordinated vulnerability disclosure process. The vendor has released version 1.2.8 to remediate the issue.

Defenders using KGS Software tia Viewer should upgrade to version 1.2.8 or later as soon as possible. Organizations should audit who has authenticated access to annotation features and review any session anomalies tied to document viewing workflows, particularly in environments where documents are shared across users with varying trust levels.

## Mentioned in this report

- Vulnerabilities: CVE-2026-105987

Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-105987

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2bfcf03a-a4be-552b-b622-06080d7fe558/kgs-software-tia-viewer-stored-xss-fixed.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup