CVE-2025-0049 — Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0

CVE-2025-0049

Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0 PUBLISHED

Description (CNA)

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.

Affected (CNA)

Vendor / product	Versions
Fortra / GoAnywhere	affected 0 before 7.8

CWE

CWE-209

References

https://www.fortra.com/security/advisories/product-security/fi-2025-004

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.