Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0

Description

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.

Scores

EPSS (exploitation in 30 days)

0.27% · top 80% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.5.

Weakness

• CWE-209 Generation of Error Message Containing Sensitive Information (opens in a new tab)All about CWE-209 and its CVEs

Affected products

• Fortra · GoAnywhere

  • affected < 7.8

What to do

Solution: Upgrade to GoAnywhere 7.8.0 or later.

Workaround: This issue occurs when the Web User does not have Create permission on Subfolders. It is a bug that happens when a user tries to upload a file to a directory that doesn’t exist yet (If they have permissions to create sub directories, then the non-existent directory would be created automatically). Note: This workaround requires supplying an additional permission that the Web User does not have in vulnerable configurations.

References (1)

• https://www.fortra.com/security/advisories/product-security/fi-2025-004 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-0049](https://trackcve.app/badge/CVE-2025-0049.svg)](https://trackcve.app/cve/CVE-2025-0049)

Record last updated 28 Apr 2025, 22:28 UTC.