Skip to content
OpenAdvisories
Medium · 6.8 CVE-2025-53897 EUVD-2025-199897

Kiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability

Published Nov 29, 2025 · Updated Dec 1, 2025 · Assigned by GitHub_M

Description

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a specifically crafted fake page of Kiteworks MFT. This issue has been patched in version 9.1.0.

Affected products

VendorProductAffectedFixed
kiteworks security-advisories < 9.1.0 —

References