CVE-2026-15913 in GoAnywhere MFT
Summary
by MITRE • 09/09/2026
In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The identified security flaw resides within the /attachRemoteFiles endpoint of Fortra’s GoAnywhere Managed File Transfer software in versions prior to 7.10.2. This vulnerability is classified as a path traversal issue, which fundamentally stems from insufficient validation and sanitization of user-supplied input when processing file attachment requests. The core technical failure involves the application's inability to properly canonicalize or restrict file paths provided by authenticated users. When a Web User with both Secure Folders and Secure Mail permissions interacts with this endpoint, the system processes the requested file path without adequately ensuring that it remains within the boundaries of the user’s designated sandboxed home directory. This lack of strict boundary enforcement allows an attacker to manipulate the input string using standard traversal sequences such as dot-dot-slash or encoded variants thereof. By injecting these sequences into the request parameters, the malicious actor can direct the server to access files located outside the intended restricted environment, effectively bypassing the application-level sandbox controls designed to isolate user data and prevent unauthorized cross-directory access.
The operational impact of this vulnerability is significant for organizations relying on GoAnywhere MFT for secure file transfers involving sensitive information. An attacker who successfully exploits this path traversal flaw can achieve arbitrary file read capabilities across the underlying operating system, subject only to the permissions of the service account running the application process. This means that confidential documents, configuration files containing credentials or API keys, database dumps, and other critical system resources become accessible to unauthorized parties. The requirement for the attacker to possess both Secure Folders and Secure Mail permissions limits the attack surface to authenticated users with specific roles within the platform, but this does not mitigate the severity of the data exposure once access is gained. The compromise undermines the integrity and confidentiality guarantees provided by the secure folder architecture, potentially leading to further lateral movement or privilege escalation if sensitive configuration files are read and their contents leveraged in subsequent attacks against other components of the infrastructure.
From a classification perspective, this vulnerability aligns with Common Weakness Enumeration identifier CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This weakness describes scenarios where software does not properly neutralize special elements within file paths that can cause files or directories to be located outside of the intended restricted directory. In terms of offensive security tactics, this exploitation technique corresponds to ATT&CK tactic T1083: File and Directory Discovery, specifically through methods like Path Traversal. The attacker utilizes valid application functionality in an unintended manner to enumerate and access sensitive data structures that are not meant for public or unauthorized consumption. This behavior is characteristic of post-exploitation activities where the initial foothold allows for deeper reconnaissance and extraction of high-value assets from within a seemingly secure perimeter.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Organizations running GoAnywhere MFT should upgrade to version 7.10.2 or later, which includes patches addressing this specific path traversal logic error in the /attachRemoteFiles endpoint. In environments where patching is not immediately feasible due to operational constraints, network-level controls can provide temporary relief by restricting access to the vulnerable endpoints from untrusted networks and ensuring that only authorized IP addresses can reach the management interface or web application components. Additionally, implementing strict input validation at a WAF level to block common path traversal patterns may reduce exposure, though this is not a substitute for code-level fixes. Security teams should also audit user permissions within GoAnywhere MFT to ensure that the principle of least privilege is strictly enforced, minimizing the number of users who hold both Secure Folders and Secure Mail privileges unless absolutely necessary for their job functions. Regular vulnerability scanning and penetration testing focused on file handling endpoints are recommended to detect similar implementation flaws in other parts of the application stack before they can be exploited by malicious actors seeking unauthorized data access.