CVE-2026-102089 is a path traversal vulnerability (CWE-22) in Kiteworks Email Protection Gateway prior to version 9.5.0. The issue exists in an administrative import function that improperly limits pathname access, allowing an authenticated administrator to write files outside the intended directory. This unauthorized file write capability could be leveraged to execute arbitrary code on the server hosting the product.

An attacker with authenticated administrator privileges can exploit this vulnerability to write files to arbitrary locations on the server, potentially leading to arbitrary code execution. This compromises confidentiality, integrity, and availability of the affected system, as reflected by the CVSS 3.1 score of 7.2 (high severity).

Upgrade Kiteworks Email Protection Gateway to version 9.5.0 or later, where this vulnerability is fixed. Since the vulnerability affects versions prior to 9.5.0, applying the official patch or upgrading to the fixed version is the recommended remediation.