CVE-2025-53900: Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on…

PriorityP355high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.00%

58.3th percentile

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for authorized users. This issue has been patched in version 9.1.0.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
accellion	kiteworks_managed_file_transfer	< 9.1.0	9.1.0
cesanta	mongoose	>= 0 < 6.13.6	6.13.6
cesanta	mongoose	>= 7.0.0-rc0 < 7.8.4	7.8.4
cesanta	mongoose	>= 8.0.0-rc0 < 8.9.5	8.9.5
kiteworks	security-advisories	< 9.1.0	9.1.0

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ghsa9.1CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.