CVE-2026-15913: GoAnywhere MFT Path Traversal Vulnerability

CVE-2026-15913 Overview

CVE-2026-15913 is a path traversal vulnerability [CWE-23] in Fortra's GoAnywhere Managed File Transfer (MFT) product. The flaw resides in the /attachRemoteFiles endpoint and affects versions prior to 7.10.2. Authenticated Web Users holding both Secure Folders and Secure Mail permissions can escape their sandboxed home directory and read arbitrary files on the host. The vulnerability requires network access and low-privilege authentication, but no user interaction. Fortra addressed the issue in GoAnywhere MFT version 7.10.2 and documented the fix in security advisory FI-2026-011.

Critical Impact
Authenticated Web Users can read arbitrary files outside their sandboxed home directory, exposing configuration files, credentials, and other transferred data on the GoAnywhere MFT server.

Affected Products

Fortra GoAnywhere MFT versions prior to 7.10.2
Deployments exposing the /attachRemoteFiles endpoint to Web Users
Instances where Web Users hold both Secure Folders and Secure Mail permissions

Discovery Timeline

2026-09-09 - CVE-2026-15913 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-15913

Vulnerability Analysis

The vulnerability exists in the /attachRemoteFiles endpoint of GoAnywhere MFT. This endpoint accepts file path parameters used to attach remote files to Secure Mail messages. The endpoint fails to properly normalize and validate user-supplied paths against the Web User's sandboxed home directory. As a result, a Web User with both Secure Folders and Secure Mail permissions can supply traversal sequences to reference files outside the intended sandbox. Successful exploitation grants arbitrary file read on the underlying host, subject to the file system permissions of the GoAnywhere service account. The scope change reflected in the CVSS vector indicates the impact extends beyond the vulnerable component to resources it should not access.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified as [CWE-23]. The /attachRemoteFiles handler concatenates or resolves the supplied path without canonicalization and without enforcing that the resolved path remains within the Web User's home directory. Traversal sequences such as ../ are not stripped or rejected before the file read operation occurs.

Attack Vector

Exploitation requires an authenticated Web User account with both Secure Folders and Secure Mail permissions assigned. The attacker sends a crafted request to /attachRemoteFiles with a path parameter containing directory traversal sequences that reference files outside the sandbox. The server resolves the path and returns file contents, allowing the attacker to enumerate and exfiltrate sensitive files. No user interaction is required, and the attack is delivered over the network. Refer to the Fortra Security Advisory FI-2026-011 for vendor-provided technical details.

Detection Methods for CVE-2026-15913

Indicators of Compromise

HTTP requests to /attachRemoteFiles containing traversal sequences such as ../, ..%2f, or encoded variants in path parameters
Access log entries showing Web Users referencing files outside their assigned home directory paths
Unexpected file read activity by the GoAnywhere service account targeting configuration files, userdatastore directories, or system paths

Detection Strategies

Inspect GoAnywhere MFT access logs for requests to /attachRemoteFiles and correlate the requesting Web User with the referenced file paths
Deploy web application firewall (WAF) rules that flag path traversal patterns in requests to GoAnywhere endpoints
Baseline normal Web User file access patterns and alert on deviations that reference paths outside sandboxed directories

Monitoring Recommendations

Forward GoAnywhere MFT application and audit logs to a centralized logging platform for retention and correlation
Monitor for Web Users assigned both Secure Folders and Secure Mail permissions, as this combination is required for exploitation
Alert on file read activity by the GoAnywhere service account targeting sensitive files such as database.properties, private keys, or user credential stores

How to Mitigate CVE-2026-15913

Immediate Actions Required

Upgrade Fortra GoAnywhere MFT to version 7.10.2 or later as documented in advisory FI-2026-011
Audit Web User accounts and remove the combination of Secure Folders and Secure Mail permissions where not required
Restrict network exposure of the GoAnywhere administrative and Web User interfaces to trusted networks

Patch Information

Fortra has released GoAnywhere MFT version 7.10.2 to remediate this path traversal vulnerability. Administrators should review the Fortra Security Advisory FI-2026-011 for upgrade guidance and version-specific instructions. Apply the patch through the standard GoAnywhere upgrade process and verify version information after installation.

Workarounds

Revoke either the Secure Folders or Secure Mail permission from Web User accounts that do not require both, breaking the prerequisite for exploitation
Place the GoAnywhere MFT web interface behind a reverse proxy or WAF configured to block path traversal sequences in request parameters
Restrict file system permissions of the GoAnywhere service account to limit the blast radius of any arbitrary file read

bash

# Example WAF rule pattern to block traversal sequences on the affected endpoint
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@beginsWith /attachRemoteFiles" \
  "phase:2,deny,status:403,id:1026015913,\
   chain,msg:'CVE-2026-15913 path traversal attempt'"
  SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"