---
id: CVE-2026-105265
title: Kiloview E3 NDI Encoder Path Traversal
summary: >-
  A vulnerability exists in the the time zone parameter and does not properly
  validate user input, which may allow an authenticated user to cause
  /etc/localtime to point to a file outside the intended zoneinfo directory


  .
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: Kiloview
product: E3 Firmware
affected:
  - e3_firmware < 1.30
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T21:58:34.789Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105265'
references:
  - url: 'https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/'
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01'
  - url: >-
      https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-01.json
tags:
  - cve.org
ingestedAt: '2026-10-22T23:08:45.762Z'
---

## Overview

A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory

.

## Affected

- `e3_firmware < 1.30`

## Remediation

KiloView recommends users update to V1.30:  https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/