CVE-2026-105265: Kiloview E3 NDI Encoder Path Traversal

Received

Published 22-10-2026Last modified 22-10-2026

Vulnerability summary

CVE-2026-105265 is a medium (CVSS 6.0) Path Traversal vulnerability in kiloview e3 firmware.

Overall risk

24/100

0100

Low · default modelHow is this calculated?

CVSS score

6.0/10

010

Medium · v4.0 (CVE.org)

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

22-10-2026
PublishedVulnerability first disclosed.

Description

A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory .

CVSS metrics

4 scores · 2 sources · 2 versions

v4.06.0v3.15.3

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Kiloview1 product

e3 firmware< 1.30

1 vendor · 1 product

References

3 links