File Upload Vulnerability in GoAnywhere by Fortra
CVE-2025-0049

4.3MEDIUM

Key Information:

Vendor

Fortra
Status
Goanywhere
Vendor
CVE Published:
28 April 2025

What is CVE-2025-0049?

A file upload vulnerability exists in GoAnywhere that allows web users, lacking proper permissions to create subfolders, to upload files to nonexistent directories. When this occurs, an error message is returned that discloses the absolute server path. This exposure can potentially lead to Fuzzing attacks, assisting malicious users in mapping out the application structure more effectively. The vulnerability impacts all versions of GoAnywhere prior to 7.8.0.

Affected Version(s)

GoAnywhere 0 < 7.8

References

https://www.fortra.com/security/advisories/product-securi...
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.