CVE-2026-102089: Kiteworks Email Protection Gateway path traversal
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Email Protection Gatewayto a version that resolves this vulnerability.Fixed in 9.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated administrator is required to use the vulnerable administrative import function. The provided data does not indicate that unauthenticated or lower-privileged users can exploit it.
Which deployments are affected?
Kiteworks Email Protection Gateway versions before 9.5.0 are affected. Version 9.5.0 is identified as the fixed boundary.
What is the likely impact of successful exploitation?
An administrator could write files to arbitrary locations on the server through path traversal. This could potentially be leveraged to execute arbitrary code on the underlying system.