Description
An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate vulnerability to place the file in an executable location.
Published: 2026-09-30
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted upload of dangerous file type
Action: Implement Mitigation
AI Analysis

Impact

An unauthenticated attacker can upload a file with attacker-controlled content to the appliance filesystem through an administrative upload handler that does not require authentication. The vulnerability allows write access to arbitrary files but does not directly succeed in executing code; execution would require a separate flaw that places a file in an executable location. The weakness corresponds to improper authentication (CWE-306) and improper file type validation (CWE-434).

Affected Systems

Kiteworks Email Protection Gateway is affected by this issue. No specific version information is listed in the advisory.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web‑based administrative upload action that lacks authentication controls. An attacker can exploit this by sending a crafted file through the exposed upload endpoint, potentially compromising integrity and confidentiality of the appliance files.

Generated by OpenCVE AI on September 30, 2026 at 22:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict the upload operation to authenticated administrators only by ensuring proper access checks before accepting file uploads.
  • Validate uploaded file types rigorously, rejecting any dangerous or unexpected file extensions or content types.
  • Audit upload logs regularly for unauthorized upload attempts and anomalous file content.

Generated by OpenCVE AI on September 30, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Kiteworks
Kiteworks kiteworks Email Protection Gateway
Vendors & Products Kiteworks
Kiteworks kiteworks Email Protection Gateway

Wed, 30 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate vulnerability to place the file in an executable location.
Title Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type
Weaknesses CWE-306
CWE-434
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Kiteworks Kiteworks Email Protection Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: cisa-cg

Published:

Updated: 2026-10-01T15:28:05.636Z

Reserved: 2026-09-28T17:39:13.564Z

Link: CVE-2026-102143

cve-icon Vulnrichment

Updated: 2026-10-01T15:27:11.015Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T21:17:03.143

Modified: 2026-10-01T16:17:33.493

Link: CVE-2026-102143

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T15:30:08Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function

  • CWE-434

    Unrestricted Upload of File with Dangerous Type