Kiteworks Core content injection
Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.
CVE-2026-102090
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-102090
Core
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Kiteworks",
"product": "Core",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "9.5.1",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.5.1"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-102090
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #5125 · Revision 1
- Added to Heist Feed
- Publisher date