CVE-2026-102143

Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type

Published Sep 30, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate vulnerability to place the file in an executable location.

Analysis

Technical impact

An unauthenticated attacker can upload a file with attacker-controlled content to the appliance filesystem through an administrative upload handler that does not require authentication. The vulnerability allows write access to arbitrary files but does not directly succeed in executing code; execution would require a separate flaw that places a file in an executable location. The weakness corresponds to improper authentication (CWE-306) and improper file type validation (CWE-434).

Affected Systems

Kiteworks Email Protection Gateway is affected by this issue. No specific version information is listed in the advisory.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web‑based administrative upload action that lacks authentication controls. An attacker can exploit this by sending a crafted file through the exposed upload endpoint, potentially compromising integrity and confidentiality of the appliance files.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Kiteworks

Email Protection Gateway

unknown

Version	Status	Constraints
`0`	affected	< 9.5.1
`9.5.1`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Kiteworks

Kiteworks Email Protection Gateway

Version	Status	Scheme	Platform
`[0,9.5.1)`	affected	generic	—
`9.5.1`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Restrict the upload operation to authenticated administrators only by ensuring proper access checks before accepting file uploads.
Validate uploaded file types rigorously, rejecting any dangerous or unexpected file extensions or content types.
Audit upload logs regularly for unauthorized upload attempts and anomalous file content.

Generated by OpenCVE AI on September 30, 2026 at 22:50 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.322% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-3p9g-jh62-8f89
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

History

Oct 13, 2026 12:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Accellion Accellion kiteworks
CPEs		cpe:2.3:a:accellion:kiteworks::::::::
Vendors & Products		Accellion Accellion kiteworks

Oct 1, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 1, 2026 3:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Kiteworks Kiteworks kiteworks Email Protection Gateway
Vendors & Products		Kiteworks Kiteworks kiteworks Email Protection Gateway

Sep 30, 2026 8:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate vulnerability to place the file in an executable location.
Title		Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type
Weaknesses		CWE-306 CWE-434
References		https://github.com/kiteworks/security-advisories/security/advisories/GHSA-3p9g-jh62-8f89 https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}`