CVE-2025-65640: Stored XSS in Arket Globe Document Intelligence 5.0.0.559

Technical summary

The vulnerability stems from insufficient input validation and output encoding in the document creation workflow. When users submit text containing JavaScript payloads to specific fields on the "Task in Progress / Recent" page, the application fails to sanitize or HTML-escape the content before rendering it in the DOM. This allows attacker-controlled script tags or event handlers to execute with the security context of legitimate users' sessions. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

Exploitation enables attackers with valid credentials to compromise other users' sessions and perform unauthorized actions within the application. Potential impacts include unauthorized document access or modification, credential harvesting through phishing overlays, lateral movement within the organization, or exfiltration of sensitive intelligence data processed by the Document Intelligence platform. The attack requires prior authentication but does not require administrator privileges, making it accessible to any legitimate user account.

Affected systems

Arket Globe Document Intelligence version 5.0.0.559 is confirmed vulnerable. Organizations running this specific build should assume exposure. Verify your installed version against this build number; later patches may already address this issue, but earlier versions should be assessed as potentially vulnerable as well pending vendor guidance.

Exploitability

Exploitability is moderately straightforward. The attack requires valid credentials (reducing opportunistic risk) but does not require social engineering of victims—the malicious document simply needs to be viewable by target users. No special browser plugins or client-side vulnerabilities are needed; standard XSS payloads suffice. The attack vector is network-accessible, and the vulnerability can be reliably triggered by submitting structured payloads to the document creation interface.

Remediation

Contact Arket Globe to obtain a patched version of Document Intelligence. Verify the availability and contents of any security updates released after the CVE publication date (2026-06-04). Implement comprehensive input validation and output encoding in all user-facing forms and rendering logic to eliminate XSS attack surface.

Patch guidance

Check the Arket Globe security advisories and support portal for patches issued on or after 2026-06-17 (the vulnerability modification date). Patches should be applied to all instances of Document Intelligence in your environment. Prior to patching, consider restricting access to the affected application or disabling the document creation feature if operationally feasible. Test patches in a non-production environment before deployment.

Detection guidance

Monitor for XSS-like payloads in document creation requests (e.g., script tags, event handler attributes, JavaScript URIs). Review access logs and document audit trails for suspicious new documents created by low-privileged or external users. Perform manual review of recently created documents for embedded JavaScript or encoded payloads. Deploy web application firewalls configured to detect and block common XSS patterns in POST requests to the vulnerable endpoint.

Why prioritize this

Medium severity due to the requirement for valid authentication and the need for victims to view the malicious document. However, the combination of high confidentiality impact (credential and data theft) with low barrier to exploitation among authenticated users warrants prompt patching. Organizations with large user bases or sensitive document repositories should escalate priority.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a network-accessible vulnerability requiring valid credentials (PR:L) and user interaction (UI:R) to trigger. The high confidentiality impact (C:H) reflects the ability to steal session tokens or sensitive data; the limited integrity impact (I:L) reflects that the attacker modifies document display rather than underlying data. Availability is not affected (A:N).

Frequently asked questions