CVE-2025-53939

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly elevate another user's permissions on the share. This issue has been patched in version 9.1.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Nov 29, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-53949.8The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing cap CVE-2025-539408.5Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's CVE-2025-539416.1Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML for CVE-2025-539427.4authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In vers CVE-2025-539438.7VoidBot Open-Source is a customizable Discord bot. VoidBot Open-Source versions 0.0.1 through 0.8.1 contain a vulnerability in the command h CVE-2025-539447.7AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents. In v0.6.15 and below, the e CVE-2025-539457.0apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5,CVE-2025-539468.8WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was i CVE-2025-539477.7A local attacker with low privileges on the Windows system where the software is installed can exploit this vulnerability to corrupt sensi CVE-2025-539487.5The Sante PACS Server allows a remote attacker to crash the main thread by sending a crafted HL7 message, causing a denial-of-service condit CVE-2025-539498.8An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortin CVE-2025-53958.8The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the