CVE-2025-53896

HighCVSS 8.1/10Last modified Oct 7, 2026

Description

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published
Nov 29, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-538976.8Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker tCVE-2025-538997.2Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incCVE-2025-53909.8A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /systeCVE-2025-539008.8Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions iCVE-2025-539013.5Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set ofCVE-2025-539024.3Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition priorCVE-2025-539031.3The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/users.js` doesn't properly sanitiCVE-2025-539041.3The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/admin.js` contains code that coulCVE-2025-539054.1Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriCVE-2025-539064.1Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin can allow overwriCVE-2025-539088.3RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability iCVE-2025-539097.2mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in
CVE-2025-53896: High severity, CVSS 8.1 | Vulnix