CVE-2026-102123

accellion kiteworks

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-102123

Katalog CVE

CVSS 7.4 · High EPSS 0,99%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada accellion kiteworks. Skor CVSS 3.1 7.4 (High) menurut CNA.

Deskripsi (NVD)

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering it unavailable until an operator intervenes. Exploitation requires network access to the affected interface, which is not reachable on a fully configured appliance in its default configuration; reaching it depends on either the transient window while an appliance is first being provisioned or a non-default appliance configuration.

Rincian

Terbit di NVD
30 September 2026
Terakhir diubah
7 Oktober 2026
Status NVD
Analyzed
CVSS 3.1
7.4 (High), sumber CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari)
0,99% peluang dieksploitasi; lebih tinggi dari 61,5% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
accellion kiteworks Semua versi sebelum 9.5.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 8 Okt 2026, 00:25 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.