CVE-2026-102089CWE-22path-traversal

CVE-2026-102089

High · published October 1, 2026

CVSS v3.1
7.2
EPSS
2%
Percentile
74.8
In the wild
Unconfirmed
What it is

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01547 · 74.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-10-01T01:16Z
Affected products (1)
ProductVersionsFixed in
accellion/kiteworks< 9.5.09.5.0
References (2)
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-p853-p65q-2vc8 · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 30 SEP 20:05Z
    Kiteworks Email Protection Gateway path traversal
    cvelistv5