This vulnerability (CWE-22) in Kiteworks Email Protection Gateway permits an authenticated administrator to perform path traversal, enabling writing files outside restricted directories. By exploiting this, an attacker can cause the application to execute arbitrary code with the privileges of the underlying service account. The issue affects all versions before 9.5.0. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in remote code execution with the privileges of the service account running the application, potentially compromising confidentiality, integrity, and availability of the system. The attacker must have authenticated administrator access to the Email Protection Gateway.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access and monitor for suspicious activity.