The flaw is a path traversal condition that allows an authenticated administrator of the Kiteworks Email Protection Gateway to write a file outside the intended directory and then trigger its execution. By doing so, an attacker can run arbitrary code with the privileges of the underlying service account, potentially compromising the entire gateway instance.

The vulnerability affects the Kiteworks Email Protection Gateway. No specific version or build information is provided, so all deployed instances of this gateway could be susceptible.

The CVSS score of 7.2 indicates a high impact with a required authenticated administrative attack vector. The EPSS score of 2% suggests a low exploitation probability and the CVE is not listed in the CISA KEV catalog. Because an attacker must be a legitimate administrator, the risk is mitigated to environments that tightly control administrative access, yet the potential to execute arbitrary code remains serious if these accounts are compromised.