CVE-2026-15913 — Path Traversal in Fortra's GoAnywhere MFT Endpoint

CVE-2026-15913

Path Traversal in Fortra's GoAnywhere MFT Endpoint PUBLISHED

Description (CNA)

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.

Affected (CNA)

Vendor / product	Versions
Fortra / GoAnywhere MFT	affected 0 before 7.10.2

CWE

CWE-23

References

https://www.fortra.com/security/advisories/product-security/fi-2026-011

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.