CVE-2026-102131

HighCVSS 7.2/10Last modified Oct 8, 2026

Description

Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and executed, resulting in code execution as the gateway service account.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-178

Affected software

Vendor	Product	Versions
Kiteworks	Email Protection Gateway	< 9.5.0

References

Timeline

Published: Sep 30, 2026
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1021327.2An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged i CVE-2026-1021336.6An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied pat CVE-2026-1021345.4Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentic CVE-2026-1021356.6On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted ser CVE-2026-1021366.3In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an interna CVE-2026-1021374.1An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dang CVE-2026-1021383.3An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the se CVE-2026-1021396.5An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the request CVE-2026-102147.3A weakness has been identified in zhayujie chatgpt-on-wechat up to 2.0.8. This issue affects the function _get_safety_warning of the file ag CVE-2026-1021404.9An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the impo CVE-2026-1021416.7Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a CVE-2026-1021427.2A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stor