All vulnerabilities
CVE-2026-102090GHSA-g3hj-598g-338g

Kiteworks Core content injection

Kiteworks Core
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.5.1Fixed versionCVE List
Published30 Sep 2026Updated 2 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.

Text from CVE List

Affected versions 3

  • Coreaffected: all versions before 9.5.1CVE List
  • Coreunaffected: 9.5.1CVE List
  • Kiteworks Core, other< 9.5.1GitHub

References 2