CVE-2025-53897 MEDIUM

CVE-2025-53897: Kiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability

Vendor Kiteworks
Product security-advisories
Weakness CWE-352 · CSRF
Published November 29, 2025
Last update December 1, 2025
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a specifically crafted fake page of Kiteworks MFT. This issue has been patched in version 9.1.0.

Key dates

02Disclosure timeline

November 29, 2025 CVE published
December 1, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-54355 WordPress WP Mailster plugin <= 1.8.17.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2022-2275 WP Edit Menu <= 1.5.0 - Arbitrary Post Deletion via CSRF CVE-2024-32795 WordPress WPCal.io <= 0.9.5.8 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-25135 WordPress Custom Links On Admin Dashboard Toolbar plugin <= 3.3 - CSRF to Stored XSS vulnerability CVE-2026-1398 Change WP URL <= 1.0 - Cross-Site Request Forgery to Settings Update