CVE-2026-15913CWE-23

CVE-2026-15913

High · published September 10, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
32.3
In the wild
Unconfirmed
What it is

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.3th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2026-09-10T02:17Z
References (1)
https://www.fortra.com/security/advisories/product-security/fi-2026-011 · df4dee71-de3a-4139-9588-11b62fe6c0ff
EPSS history
Timeline
  • 11 SEP 03:16Z
    EPSS moved — → 0%
    epss
  • 09 SEP 21:18Z
    Path Traversal in Fortra's GoAnywhere MFT Endpoint
    cvelistv5