Kiteworks Core EUVD-2026-90371

Exploitation requires the victim to open an attacker-crafted link to the Kiteworks Core PDF viewer in which a URL parameter is manipulated (CWE-601 open redirect / content injection). No authentication is required of the attacker (PR:N), but success depends on user interaction (UI:R) - a victim must click the malicious link - and on the attacker persuading the victim to trust the rendered content. The impact is limited to integrity/content spoofing (I:L) under the trusted application domain; there is no direct read of appliance data or code execution. Affected: Kiteworks Core before 9.5.1; fixed in 9.5.1.

All signals point to a genuinely low-priority issue despite the 'Content Injection' framing. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3) is internally consistent with an open-redirect/content-spoofing bug: no confidentiality or availability impact, only limited integrity (I:L) reflecting the ability to render attacker-controlled content under the legitimate domain. Exploitation requires user interaction (UI:R) - a victim must click a crafted link - which is the primary limiting factor. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so this is 'no public exploit identified at time of analysis.' There are no conflicting signals: the CWE-601 (open redirect), the 'Open Redirect' tag, and the description all agree. This is a low-real-risk issue whose main value to an attacker is lending domain credibility to phishing, not direct compromise of the Kiteworks appliance. A patch is available (9.5.1), so remediation is straightforward.

An attacker crafts a link to the legitimate Kiteworks PDF viewer with a manipulated URL parameter that causes an attacker-controlled document to be loaded and displayed under the trusted application domain. The attacker sends this link in a phishing email; because the URL and rendered page appear to originate from the organization's genuine Kiteworks domain, the victim is more likely to trust the embedded malicious content or links. No public exploit code is identified, and success depends on the victim clicking the link (UI:R).