# CVE-2026-105987: Stored XSS in KGS Software tia Viewer annotation API (versions before 1.2.8)

> CERT Polska reports a stored cross-site scripting flaw (CWE-79) in the annotation API of KGS Software tia Viewer. An authenticated attacker can inject JavaScript into sticky note annotations, which executes in the browser of any user who opens the document, potentially compromising user sessions. Fixed in version 1.2.8.

- **Published:** 2026-10-27T15:19:38Z
- **Last reviewed:** 2026-10-27T15:19:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4547
- **ID:** TL-2026-4547
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-105987

## Description

CVE-2026-105987 is a stored (persistent) cross-site scripting vulnerability, classified CWE-79 (improper neutralization of input during web page generation), in the annotation API of KGS Software tia Viewer. The CERT Polska advisory (published 2026-10-27) states that an authenticated attacker can inject an arbitrary JavaScript payload into a stickynote annotation because input is not properly validated or sanitized. When other users subsequently open the annotated document, the payload executes in their browser, potentially compromising their sessions. All versions before 1.2.8 are affected; the issue is fixed in 1.2.8.

Context on the product: per KGS Software documentation, tia Viewer is a web-based viewer delivered as an OCI container image that lets SAP users view PDF, JPEG and TIFF documents retrieved from an ArchiveLink-certified SAP archive. Depending on configuration, users may add annotations that are stored alongside the document in the archive. This storage model is what makes the XSS persistent: the malicious annotation is saved with the document and replayed to every subsequent viewer.

Exploitation prerequisites and limits (from the advisory): the attacker must be authenticated and must have the ability to create annotations; the victim must open the affected document. The advisory does not provide a CVSS score, does not report in-the-wild exploitation, does not mention a public proof of concept, and lists no indicators of compromise. The severity_level of MEDIUM recorded here is an analyst-assigned placeholder reflecting an authenticated, user-interaction-required stored XSS; it is not a vendor or CERT rating. Downstream consumers should not assume active exploitation. The reporter is credited as Dawid Dudek (4c1d8urn), who reported directly to CERT Polska under its coordinated vulnerability disclosure policy. As of 2026-10-27 the CVE record page and an NVD API query returned no detailed data, so no additional CVSS/CPE enrichment was available.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1539 Steal Web Session Cookie
- T1185 Browser Session Hijacking
- T1078 Valid Accounts

## Sources

- [CERT Polska: Vulnerability in KGS Software tia Viewer software](https://cert.pl/en/posts/2026/10/CVE-2026-105987/)
- [CVE Record: CVE-2026-105987](https://www.cve.org/CVERecord?id=CVE-2026-105987)
- [CERT Polska Coordinated Vulnerability Disclosure Policy](https://cert.pl/en/cvd/)
- [KGS Software documentation: tia Viewer (core)](https://kgs-software.atlassian.net/wiki/spaces/DOCUEN/pages/3247079428/tia+Viewer+core)
- [MITRE CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)](https://cwe.mitre.org/data/definitions/79.html)
- [NVD CVE API lookup for CVE-2026-105987 (no record returned as of 2026-10-27)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-105987)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4547