Skip to content
OpenAdvisories

Vendor

Kiteworks

86 known vulnerabilities.

Products

Core 36 Email Protection Gateway 22 Secure Data Forms 15 security-advisories 10 OwnCloud 2 Kiteworks Email Protection Gateway 1 kiteworks 0
All Critical High Medium Low Exploited only Public exploit

86 results · Feed

  • Medium 6.3
    CVE-2025-53939

    Kiteworks Core is vulnerable to Improper Input Validation

    Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly elevate another user's permissions on the share. This issue has been patched in version 9.1.0.

    Kiteworks security-advisories
  • Medium 6.5
    CVE-2025-53900

    Kiteworks MFT has a Privilege Defined With Unsafe Actions

    Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for authorized users. This is…

    Kiteworks security-advisories
  • High 7.2
    CVE-2025-53899

    Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channel

    Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on th…

    Kiteworks security-advisories
  • Medium 6.8
    CVE-2025-53897

    Kiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability

    Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a specifically crafted fake…

    Kiteworks security-advisories
  • High 7.1
    CVE-2025-53896

    Kiteworks MFT is vulnerable to Insufficient Session Expiration

    Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in ve…

    Kiteworks security-advisories
  • Medium 6.8
    CVE-2023-7273

    Cross Site Request Forgery in Kiteworks OwnCloud

    Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header valu…

    Kiteworks OwnCloud