CVE-2025-53897

MediumCVSS 6.8/10Last modified Oct 7, 2026

Description

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a specifically crafted fake page of Kiteworks MFT. This issue has been patched in version 9.1.0.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Nov 29, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-538997.2Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an inc CVE-2025-53909.8A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /syste CVE-2025-539008.8Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions i CVE-2025-539013.5Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of CVE-2025-539024.3Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior CVE-2025-539031.3The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/users.js` doesn't properly saniti CVE-2025-539041.3The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/admin.js` contains code that coul CVE-2025-539054.1Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwri CVE-2025-539064.1Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin can allow overwri CVE-2025-539088.3RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability i CVE-2025-539097.2mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in CVE-2025-53918.1The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in th