The vulnerability involves improper limitation of a pathname to a restricted directory (CWE-22) in the Kiteworks Core appliance setup interface. An attacker can supply a crafted file path to write files outside the intended directory. This can lead to integrity compromise or unavailability of the appliance. Network access to the vulnerable interface is required, but this interface is typically inaccessible on fully configured appliances in default mode. The affected versions are all Kiteworks Core versions from initial releases up to but not including 9.5.0.

An unauthenticated attacker with network access to the setup interface can write files arbitrarily within locations writable by the service account. This can compromise the integrity of the appliance or render it unavailable until an operator intervenes. The attack surface is limited because the vulnerable interface is not reachable in default configurations except during initial provisioning or if the appliance is configured non-default.

No official patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerable interface is normally unreachable in default configurations, ensuring the appliance is fully configured and not in provisioning state reduces exposure. Avoid non-default configurations that expose the setup interface to untrusted networks.