CVE-2026-105265— Kiloview E3 NDI Encoder Path Traversal
Quick assessment
Affected
Kiloview E3 Firmware
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
时区参数中存在一个漏洞，该漏洞未对用户输入进行适当验证，可能导致已认证用户将 指向预期 目录之外的文件。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105265
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kiloview E3 NDI Encoder Path Traversal
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory
.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Kiloview | E3 Firmware | 0 ~ 1.30 | - |
|
II. Public POCs for CVE-2026-105265
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105265
请登录查看更多情报信息。
Other References for CVE-2026-105265 (3)
Same Patch Batch · Kiloview · 2026-10-22 · 9 CVEs total
| CVE-2026-107861 | 9.9 CRITICAL | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-110243 | 9.9 CRITICAL | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-109122 | 9.1 CRITICAL | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-92450 | 7.5 HIGH | Kiloview E3 NDI Encoder Use of Hard-coded Credentials |
| CVE-2026-110825 | 7.5 HIGH | Kiloview E3 NDI Encoder Missing Authentication for Critical Function |
| CVE-2026-110491 | 7.5 HIGH | Kiloview E3 NDI Encoder NULL Pointer Dereference |
| CVE-2026-96616 | 6.5 MEDIUM | Kiloview E3 NDI Encoder Insufficient Session Expiration |
| CVE-2026-111100 | 5.3 MEDIUM | Kiloview E3 NDI Encoder Missing Authentication for Critical Function |
IV. Related Vulnerabilities
Same product: E3 Firmware
-
CVE-2026-110825
Kiloview E3 NDI Encoder Missing Authentication for Critical -
CVE-2026-92450
Kiloview E3 NDI Encoder Use of Hard-coded Credentials -
CVE-2026-110243
Kiloview E3 NDI Encoder OS Command Injection -
CVE-2026-107861
Kiloview E3 NDI Encoder OS Command Injection -
CVE-2026-110491
Kiloview E3 NDI Encoder NULL Pointer Dereference
Same vendor: Kiloview
-
CVE-2026-110825
Kiloview E3 NDI Encoder Missing Authentication for Critical -
CVE-2026-92450
Kiloview E3 NDI Encoder Use of Hard-coded Credentials -
CVE-2026-110243
Kiloview E3 NDI Encoder OS Command Injection -
CVE-2026-107861
Kiloview E3 NDI Encoder OS Command Injection -
CVE-2026-110491
Kiloview E3 NDI Encoder NULL Pointer Dereference
Same weakness: CWE-22
-
CVE-2026-115375
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Travers -
CVE-2026-115355
Mistune before 3.3.0 Path Traversal and XSS via Include Dire -
CVE-2026-115354
Mistune before 3.3.0 Arbitrary Local File Read via Include D -
CVE-2026-115353
Mistune before 3.3.0 Path Traversal via include Directive -
CVE-2026-77156
ast-cli: Path traversal in tar extraction on Linux/macOS all
V. Comments for CVE-2026-105265
No comments yet