Description

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-09T22:17:11.367Z",
  "pubdate": "2026-09-09T22:17:11.367Z",
  "executiveSummary": "A critical path traversal vulnerability exists within the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT versions prior to 7.10.2. This vulnerability allows authenticated Web Users to bypass restricted directory sandboxing mechanisms, resulting in unauthorized arbitrary file read access on the host filesystem.\nThe vulnerability stems from improper validation of user-supplied input paths during the attachment process. By manipulating the file path parameters, a malicious actor can traverse outside the designated Secure Folder environment to access sensitive system or application files.\nThe risk is significant due to the potential for information disclosure, including configuration files, credentials, or sensitive business data residing on the server. Exploitation requires the attacker to possess active credentials and specific permissions—specifically, both Secure Folders and Secure Mail functionality must be enabled for the target account.\nSuccessful exploitation facilitates unauthorized data exfiltration, which could lead to complete system compromise if sensitive security configuration files or cryptographic material are accessed. Organizations utilizing affected versions are at high risk of data breach and should prioritize upgrading to version 7.10.2 or later to eliminate the traversal vector.",
  "technicalDetails": "The vulnerability resides within the /attachRemoteFiles endpoint of the GoAnywhere MFT application. This component is designed to facilitate the attachment of files from secure, sandboxed directories during web-based operations. However, the implementation fails to properly sanitize or validate the path input, allowing directory traversal sequences (e.g., ../) to be processed by the underlying file system API.\nRoot cause analysis indicates that the application does not sufficiently enforce boundary checks on path parameters submitted to the endpoint. When a user requests an operation involving file attachment, the application fails to verify that the target file path is contained strictly within the assigned, sandboxed Secure Folder. Consequently, the application treats user-controlled input as a legitimate path, allowing the traversal to escape the intended home directory root.\nThe exploitation flow begins with an authenticated user possessing Secure Folders and Secure Mail permissions. An attacker submits a crafted HTTP request to the /attachRemoteFiles endpoint containing a malicious payload in the file path field. By injecting traversal sequences, the attacker instructs the backend process to resolve a path outside the permitted directory structure. Because the application processes this path with the privileges of the web service, it inadvertently grants read access to arbitrary files on the server that the service account has permission to access.\nThe impact of this vulnerability is categorized as Arbitrary File Read. Once an attacker escapes the sandbox, they can navigate the filesystem to target sensitive locations. This may include reading configuration files that contain database credentials, API keys, or system-level environment variables. In some configurations, this access can be leveraged to read sensitive logs or private user data, significantly increasing the probability of a full system compromise. The vulnerability is effective because it leverages native, intended functionality—file attachment—to bypass access controls, making detection difficult for security monitoring solutions relying solely on signature-based detection for malicious file uploads. The exposure is limited to authenticated users; however, the requirement for both Secure Folders and Secure Mail permissions acts as a narrow constraint that does not mitigate the severity of the flaw, as these are common functional requirements for many enterprise users of the platform."
}