High · published October 1, 2026
An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.
| Product | Versions | Fixed in |
|---|---|---|
| accellion/kiteworks | < 9.5.1 | 9.5.1 |