DivvyDrive Information Technologies' product is vulnerable to a URL redirection flaw that allows arbitrary parameters to be injected and redirected to an untrusted site. This flaw provides an unauthenticated attacker with the ability to trick end‑users into visiting malicious domains, leading to phishing, credential theft, or defacement. The weakness is cataloged as CWE‑601, which describes improper neutralization of potential redirect content.

Systems running DivvyDrive versions from 4.8.2.9 up to before 4.8.3.2 are affected. The vulnerability applies to all deployments of DivvyDrive by DivvyDrive Information Technologies Inc. where the redirect parameter is enabled. No further patch version information is available in the CNA data, but the impact applies to all those older releases.

The CVSS score of 9.6 indicates a high‑severity risk, and because the exploit does not require authentication, the likelihood of execution is high. The EPSS score is not reported, and the vulnerability is not listed in CISA KEV, however the absence of a KEV listing does not reduce the legitimate threat. Attackers could trigger the redirect by crafting a URL to any publicly accessible endpoint, leveraging the deep injection of the redirect parameter. Once executed, the end‑user would be directed to a malicious domain controlled by the attacker, potentially compromising session state or phishing credentials. Prompt remediation is strongly advisable.