CVE-2026-15913 - Vulnerability Details - OpenCVE

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Fortra	Goanywhere Mft

No data.

No data.

References

Link	Providers
https://www.fortra.com/security/advisories/product-security/fi-2026-011

History

Thu, 10 Sep 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 10 Sep 2026 11:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fortra Fortra goanywhere Mft
Vendors & Products		Fortra Fortra goanywhere Mft

Wed, 09 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Description		In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.
Title		Path Traversal in Fortra's GoAnywhere MFT Endpoint
Weaknesses		CWE-23
References		https://www.fortra.com/security/advisories/product-security/fi-2026-011
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: Fortra

Published: 2026-09-09T21:18:54.261Z

Updated: 2026-09-10T13:49:34.773Z

Reserved: 2026-07-15T19:34:18.897Z

Link: CVE-2026-15913

Vulnrichment

Updated: 2026-09-10T13:49:20.827Z

NVD

Status : Received

Published: 2026-09-09T22:17:11.367

Modified: 2026-09-10T14:17:00.210

Link: CVE-2026-15913

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15913", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "state": "PUBLISHED", "assignerShortName": "Fortra", "dateReserved": "2026-07-15T19:34:18.897Z", "datePublished": "2026-09-09T21:18:54.261Z", "dateUpdated": "2026-09-10T13:49:34.773Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2026-09-09T21:18:54.261Z"}, "title": "Path Traversal in Fortra's GoAnywhere MFT Endpoint", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-23", "description": "CWE-23 Relative path traversal", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "affected": [{"vendor": "Fortra", "product": "GoAnywhere MFT", "modules": ["Secure Mail", "Secure Folders", "File System"], "versions": [{"status": "affected", "version": "0", "lessThan": "7.10.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In versions prior to 7.10.2 a path traversal vulnerability in the\u00a0/attachRemoteFiles endpoint\u00a0of Fortra's GoAnywhere MFT allows Web Users with both\u00a0Secure Folders and Secure Mail permissions\u00a0to escape their sandboxed home directory, achieving arbitrary file read.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read."}]}], "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2026-011", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to a remediated version (version 7.10.2 or later).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to a remediated version (version 7.10.2 or later)."}]}], "credits": [{"lang": "en", "value": "xtromera (Zerosploit) https://www.zerosploit.co/", "type": "reporter"}, {"lang": "en", "value": "ZeyadZonkorany (Zerosploit) https://www.zerosploit.co/", "type": "reporter"}, {"lang": "en", "value": "0xkalawy (Zerosploit) https://www.zerosploit.co/", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-10T13:49:14.002969Z", "id": "CVE-2026-15913", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T13:49:34.773Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15913", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "state": "PUBLISHED", "assignerShortName": "Fortra", "dateReserved": "2026-07-15T19:34:18.897Z", "datePublished": "2026-09-09T21:18:54.261Z", "dateUpdated": "2026-09-10T13:49:34.773Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2026-09-09T21:18:54.261Z"}, "title": "Path Traversal in Fortra's GoAnywhere MFT Endpoint", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-23", "description": "CWE-23 Relative path traversal", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "affected": [{"vendor": "Fortra", "product": "GoAnywhere MFT", "modules": ["Secure Mail", "Secure Folders", "File System"], "versions": [{"status": "affected", "version": "0", "lessThan": "7.10.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In versions prior to 7.10.2 a path traversal vulnerability in the\u00a0/attachRemoteFiles endpoint\u00a0of Fortra's GoAnywhere MFT allows Web Users with both\u00a0Secure Folders and Secure Mail permissions\u00a0to escape their sandboxed home directory, achieving arbitrary file read.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read."}]}], "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2026-011", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to a remediated version (version 7.10.2 or later).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to a remediated version (version 7.10.2 or later)."}]}], "credits": [{"lang": "en", "value": "xtromera (Zerosploit) https://www.zerosploit.co/", "type": "reporter"}, {"lang": "en", "value": "ZeyadZonkorany (Zerosploit) https://www.zerosploit.co/", "type": "reporter"}, {"lang": "en", "value": "0xkalawy (Zerosploit) https://www.zerosploit.co/", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15913", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T13:49:14.002969Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T13:49:20.827Z"}}]}}