EUVD-2026-90300Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable admin feature (AV:N), but requires administrator privileges (PR:H); arbitrary file placement enabling code exec supports C:H/I:H/A:H; no scope change (S:U).
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
5DescriptionCVE.org
A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system.
AnalysisAI
Path traversal (CWE-22) in Kiteworks Email Protection Gateway allows an authenticated administrator to move files to locations outside the designated directory of an optional, non-default administrative file-move feature, which can potentially be leveraged to execute arbitrary code on the underlying host. The vulnerability is network-reachable with no user interaction (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but exploitation requires high-privileged administrator credentials and that the optional feature be enabled - environments running default configurations without this feature are not exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) valid authenticated administrator access to the Kiteworks Email Protection Gateway (PR:H), and (2) that the specific optional, non-default administrative file-move feature is enabled/in use - it is not active in default configurations, so environments without this feature are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-CVSS (7.2) but realistically LOW-to-MEDIUM real-world risk issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix identified in the Kiteworks security advisory GHSA-3r3r-hp4c-pxmh (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-3r3r-hp4c-pxmh) and consult the linked CISA CSAF record for the authoritative affected-version and fixed-version details; a specific patched version number is not confirmable from the provided data, so do not assume a version without verifying against the vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether the optional administrative file-move feature is enabled across all Kiteworks Email Protection Gateway instances and immediately disable it if not strictly required; audit administrator accounts and enforce least privilege, and monitor logs for unusual file-move activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today