CVE-2026-102127

Published: Set 30, 2026 Last Modified: Set 30, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,0
Source: 9119a7d8-5eab-497f-8521-727c672e3725
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: low
Availability: low

Description

AI Translation Available

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.

611

Improper Restriction of XML External Entity Reference

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability
Potential Impacts:
Read Application Data Read Files Or Directories Bypass Protection Mechanism Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory)
Applicable Platforms
Languages: Not Language-Specific, XML
Technologies: Not Technology-Specific, Web Based
View CWE Details
https://github.com/kiteworks/security-advisories/security/a…
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-9jwc-…
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf…
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026…