CVE-2026-15913— Path Traversal in Fortra's GoAnywhere MFT Endpoint
Quick assessment
Affected
Fortra GoAnywhere MFT
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 7.10.2 之前的版本中，Fortra GoAnywhere MFT 的 端点存在路径遍历漏洞。同时拥有 Secure Folders 和 Secure Mail 权限的 Web 用户可以借此逃逸出其沙盒化的主目录，从而实现任意文件读取。
Possible ATT&CK Techniques 3 AI
T1046 · Network Service Discovery T1078 · Valid Accounts T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-15913
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path Traversal in Fortra's GoAnywhere MFT Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
相对路径遍历
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Fortra | GoAnywhere MFT | 0 ~ 7.10.2 | - |
|
II. Public POCs for CVE-2026-15913
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15913
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: GoAnywhere MFT
-
CVE-2026-1089
User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allow -
CVE-2026-0972
HTML Injection possible in system generated emails in Fortra -
CVE-2026-0971
GoAnywhere MFT SAML Sessions do not redirect to logout URL o -
CVE-2025-14362
GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force -
CVE-2025-1241
Encryption vulnerable to brute-force decryption in GoAnywher
Same vendor: Fortra
-
CVE-2026-12164
Privilege Escalation in Fortra File Integrity Monitoring (FI -
CVE-2026-12163
Stored XSS in Fortra File Integrity Monitoring (FIM) -
CVE-2026-9863
Core Privileged Access Manager (BoKS) upgrade tooling comman -
CVE-2026-9862
Core Privileged Access Manager (BoKS) autoregistration servi -
CVE-2026-1089
User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allow
Same weakness: CWE-23
-
CVE-2026-84939
Apache FreeMarker, Apache FreeMarker: A malformed locale may -
CVE-2026-79728
Dell SCG 5.0 相对路径遍历漏洞 -
CVE-2026-87747
Ragic｜Enterprise Cloud Database - Arbitrary File Read -
CVE-2026-47680
Source controller: Improper path handling allows traversal -
CVE-2026-77897
Microsoft Power Automate Desktop Elevation of Privilege Vuln
V. Comments for CVE-2026-15913
No comments yet