CVE-2026-102090 in Kiteworks
Summary
by MITRE • 10/01/2026
Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Kiteworks Core prior to version 9.5.1 represents a significant security flaw within its PDF viewing component, specifically categorized under CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or Content Injection. The root cause lies in the insufficient validation and sanitization of URL parameters passed to the document viewer module. When users interact with links that point to external PDF documents, the application constructs a request context without adequately verifying whether the target resource originates from a trusted source or adheres to strict content security policies. This lack of rigorous input validation allows an attacker to inject malicious URLs into the parameter space, effectively tricking the client-side application into loading and rendering untrusted content within the browser window that is otherwise associated with the legitimate Kiteworks domain.
From a technical perspective, this flaw exploits the browser's same-origin policy assumptions by leveraging the trust relationship between the user session and the application interface. By embedding malicious links or scripts within the displayed PDF metadata or using crafted URLs to load external resources, an attacker can execute arbitrary code in the context of the vulnerable web application. This capability transforms a standard document viewing feature into a vector for client-side attacks. The vulnerability is particularly dangerous because it operates at the intersection of content delivery and user interaction, allowing attackers to bypass traditional perimeter defenses that might otherwise block direct access to sensitive internal resources.
The operational impact of this Content Injection vulnerability extends beyond simple code execution; it serves as a powerful enabler for sophisticated phishing campaigns. Because the malicious content is rendered within the trusted UI frame of Kiteworks Core, victims are more likely to perceive the injected material as legitimate and safe. This increased credibility significantly lowers the barrier for social engineering attacks, where attackers can embed deceptive forms, fake login prompts, or harmful instructions directly into the viewed document context. Users interacting with these compromised documents may inadvertently disclose sensitive credentials, personal identifiable information, or corporate secrets under the false impression that they are engaging with a verified and secure enterprise platform.
In terms of industry classification frameworks, this vulnerability aligns closely with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically when used for phishing via trusted domains to establish initial access. It also relates to CWE-20: Improper Input Validation, as the core failure is the acceptance of untrusted data without proper validation checks against a whitelist or strict schema definitions. The exploitation path typically involves an attacker crafting a malicious URL that points to a server under their control, which hosts content designed to exploit browser rendering engines or inject JavaScript payloads that interact with the parent window's DOM elements.
To mitigate this vulnerability, organizations must immediately upgrade Kiteworks Core to version 9.5.1 or later, where these input validation mechanisms have been hardened. In addition to patching, administrators should implement strict Content Security Policy headers that restrict the sources from which content can be loaded within the application frame. This includes enforcing same-origin policies for embedded resources and disabling inline scripts unless absolutely necessary. Furthermore, user awareness training is critical; employees should be educated to verify URLs before clicking on links provided by colleagues or external parties, even if those links appear within trusted applications. Regular security audits of web application configurations and continuous monitoring for anomalous content loading patterns can further reduce the risk surface associated with this class of injection flaws.