PT-2025-48358 · Kiteworks · Kiteworks Mft

Published 2025-11-29 · Updated 2025-12-03 · CVE-2025-53897

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kiteworks MFT versions prior to 9.1.0

Description Kiteworks MFT orchestrates end-to-end file transfer workflows. Versions of the software prior to 9.1.0 contain a flaw that could allow an external attacker to access log information from the system. This is achieved by deceiving an administrator into viewing a specially designed, fraudulent page within Kiteworks MFT. The issue was addressed with the release of version 9.1.0.

Recommendations Upgrade to Kiteworks MFT version 9.1.0 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-53897

GHSA-CXWC-7899-3H4M

Affected Products

Kiteworks Mft

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53897.json · Exploit
• https://github.com/kiteworks/security-advisories/security/advisories/GHSA-cxwc-7899-3h4m · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-53897 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53897 · Vendor Advisory
• https://t.me/cveNotify/144635 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1994626000055894125 · Twitter Post
• https://t.me/cveNotify/144319 · Telegram Post
• https://t.me/CVEtracker/38455 · Telegram Post