← Back

CVE-2025-53899

nvd nist
Published: Nov 29, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: security-advisories@github.com (Secondary)

Description

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0.

Affected (1)

Accellion
1 product
Kiteworks Managed File Transfer
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Kiteworks Managed File Transfer
Before 9.1.0

Related CWEs

CWE-941
Incorrectly Specified Destination in a Communication Channel
The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.

References (1)

Source: security-advisories@github.com
PatchThird Party Advisory

Timeline

No history available yet.