CVE-2026-102105: Kiteworks Email Protection Gateway server-side request forgery

Analysis on rafaelpfister.ch

Article · October 31, 2026 totemomail 9.5.1: Account takeover in the Web Portal and SSRF via incoming email fixed totemomail 9.5.1 fixes eight security vulnerabilities and brings totemomail in line with the Kiteworks advisories for Email Protection Gateway published at the end of September. Two vulnerabilities can be exploited without authentication: a flaw in the Web Portal password reset process that allows administrator accounts to be taken over, and server-side retrieval of URLs from incoming messages. The release also includes path traversal fixes in the Admin API and Mail API, as well as updated Tomcat and Batik libraries.

Vendor description

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway renders message content that references external resources. Depending on the services reachable from the gateway, this could disclose sensitive internal information or trigger unintended actions on internal systems.

Reference data

Vendor

Kiteworks

Affected products

Email Protection Gateway

CVSS 3.1

9.1 (CRITICAL)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness type

CWE-918: Server-Side Request Forgery

Published

September 30, 2026

Official sources

← All vulnerabilities

CVE-2026-102105 Kiteworks Email Protection Gateway server-side request forgery

Analysis on rafaelpfister.ch

Vendor description

Reference data

Official sources

Subscribe