CVE-2026-102089

Received Received - Intake

Path Traversal in Kiteworks Email Protection Gateway

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102089

EUVD

EUVD-2026-90369

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	email_protection_gateway	to 9.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Kiteworks Email Protection Gateway before version 9.5.0 has a path traversal vulnerability in an administrative import function. An authenticated administrator can write files to arbitrary locations on the server, which could allow them to execute arbitrary code on the system.

Impact Analysis

This vulnerability allows an attacker with administrative access to write files anywhere on the server. This could lead to full system compromise, unauthorized data access, or further attacks on the network.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR and HIPAA requirements for data protection and integrity. Organizations using affected versions may face compliance violations and penalties.

Mitigation Strategies

Immediately upgrade Kiteworks Email Protection Gateway to version 9.5.0 or later to address the path traversal vulnerability in the administrative import function.

Hi! I’m here to help you understand CVE-2026-102089. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70