This vulnerability (CWE-22) in Kiteworks Email Protection Gateway involves improper limitation of a pathname to a restricted directory. An authenticated administrator using an optional, non-default administrative feature can move files to unintended locations outside the designated directory. This path traversal flaw could be exploited to execute arbitrary code on the underlying system. The issue affects versions before 9.5.0.

Successful exploitation allows an authenticated administrator to move files outside the intended directory, potentially leading to arbitrary code execution on the system. This compromises confidentiality, integrity, and availability of the affected system.

No explicit patch or remediation details are provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity related to file operations in the affected feature.