Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-15913

Path Traversal in Fortra's GoAnywhere MFT Endpoint

CVSS 3.1 7.7 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-15913

Published

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-15913

Published

GoAnywhere MFT

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Fortra",
                    "product": "GoAnywhere MFT",
                    "modules": [
                        "Secure Mail",
                        "Secure Folders",
                        "File System"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "7.10.2",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON