CVE-2025-0049

Published: Apr 28, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.

Affected (1)

Products: Fortra: Goanywhere Managed File Transfer

1 product

Goanywhere Managed File Transfer

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fortra Goanywhere Managed File Transfer	Before 7.8.0

Related CWEs

Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

References (1)

https://www.fortra.com/security/advisories/product-security/fi-2025-004

Source: df4dee71-de3a-4139-9588-11b62fe6c0ff

Vendor Advisory

Timeline

No history available yet.