CVE-2026-102090: Kiteworks Core content injection
Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Coreto a version that resolves this vulnerability.Fixed in 9.5.1
Event History
Frequently Asked Questions
Which deployments are affected?
Kiteworks Core versions before 9.5.1 are affected. The provided information does not identify any additional configuration prerequisites.
What does an attacker need to exploit this issue?
An attacker needs to persuade a user to interact with a malicious link that causes attacker-controlled content to be loaded in the Kiteworks PDF viewer. No attacker privileges are required, but user interaction is required.
What is the practical impact?
The issue can display an attacker-controlled document under the trusted legitimate application domain, making embedded malicious links more credible for phishing. The stated impact is integrity-related; no confidentiality or availability impact is listed.
What should be done to remediate it?
Upgrade Kiteworks Core to version 9.5.1 or later. The provided information does not specify an alternative mitigation for environments that cannot patch immediately.