PT-2025-18117 · Unknown · Goanywhere

Published 2025-04-28 · Updated 2025-05-10 · CVE-2025-0049

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GoAnywhere versions prior to 7.8.0

Description The issue occurs when a web user without create permission on subfolders attempts to upload a file to a non-existent directory. In this scenario, the error message includes the absolute server path, which may allow for application mapping through fuzzing.

Recommendations For versions prior to 7.8.0, update to version 7.8.0 or later to resolve the issue.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2025-0049

Affected Products

Goanywhere

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-0049 · Security Note
• https://fortra.com/security/advisories/product-security/fi-2025-004 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-0049 · Vendor Advisory
• https://t.me/cvedetector/23945 · Telegram Post
• https://reddit.com/r/Fortra/comments/1ka6kqf/28apr2025_fi2025004_fortras_goanywhere_disclosure · Reddit Post
• https://t.me/cvenotify/121623 · Telegram Post
• https://t.me/cvetracker/22569 · Telegram Post
• https://twitter.com/CVEnew/status/1916963941701255646 · Twitter Post