CVE-2026-102090: Kiteworks Core content injection

Q: Which deployments are affected?

Kiteworks Core versions before 9.5.1 are affected. The provided information does not identify any additional configuration prerequisites.

Q: What does an attacker need to exploit this issue?

An attacker needs to persuade a user to interact with a malicious link that causes attacker-controlled content to be loaded in the Kiteworks PDF viewer. No attacker privileges are required, but user interaction is required.

Q: What is the practical impact?

The issue can display an attacker-controlled document under the trusted legitimate application domain, making embedded malicious links more credible for phishing. The stated impact is integrity-related; no confidentiality or availability impact is listed.

Q: What should be done to remediate it?

Upgrade Kiteworks Core to version 9.5.1 or later. The provided information does not specify an alternative mitigation for environments that cannot patch immediately.

Published Sep 30, 2026

Updated

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.

Affected Software

1 affected component

Kiteworks Core<9.5.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kiteworks Core to a version that resolves this vulnerability.
Fixed in 9.5.1

Event History

Sep 30, 2026

CVE Published

via MITRE·08:05 PM

Data Sourced

via MITRE·08:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Kiteworks Core versions before 9.5.1 are affected. The provided information does not identify any additional configuration prerequisites.

What does an attacker need to exploit this issue?

An attacker needs to persuade a user to interact with a malicious link that causes attacker-controlled content to be loaded in the Kiteworks PDF viewer. No attacker privileges are required, but user interaction is required.

What is the practical impact?

The issue can display an attacker-controlled document under the trusted legitimate application domain, making embedded malicious links more credible for phishing. The stated impact is integrity-related; no confidentiality or availability impact is listed.

What should be done to remediate it?

Upgrade Kiteworks Core to version 9.5.1 or later. The provided information does not specify an alternative mitigation for environments that cannot patch immediately.

CVE-2026-102090: Kiteworks Core content injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the practical impact?

What should be done to remediate it?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the practical impact?

What should be done to remediate it?