---
id: CVE-2026-102119
title: >-
  A path traversal weakness in an optional, non-default administrative feature
  allowed an authenticated administrator to move files to unintended locations
  outside the feature's designated directory
summary: >-
  A path traversal weakness in an optional, non-default administrative feature
  allowed an authenticated administrator to move files to unintended locations
  outside the feature's designated directory. This could potentially be
  leveraged to …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
vendor: accellion
product: kiteworks
affected:
  - kiteworks < 9.5.0
patched:
  - kiteworks 9.5.0
published: '2026-09-30'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T12:00:17.210'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102119'
references:
  - url: >-
      https://github.com/kiteworks/security-advisories/security/advisories/GHSA-3r3r-hp4c-pxmh
    label: 9119a7d8-5eab-497f-8521-727c672e3725
  - url: >-
      https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json
    label: 9119a7d8-5eab-497f-8521-727c672e3725
tags:
  - nvd
  - cve.org
epss: 0.01394
epssPercentile: 0.72463
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-01T13:28:08.358537Z'
ingestedAt: '2026-09-30T21:25:07.828Z'
---

## Overview

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system.

## Affected

- `kiteworks < 9.5.0`

## Remediation

Upgrade past the affected range:

- `kiteworks 9.5.0`