PT-2025-49314 · Fortra · Goanywhere Mft

Published 2025-12-05 · Updated 2026-01-30 · CVE-2025-8148

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GoAnywhere MFT versions prior to 7.9.0

Description An improper access control exists in the SFTP service. This affects web users who have an authentication alias and a valid SSH key, but are limited to password authentication for SFTP. These users can still log in using their SSH key.

Recommendations Update to version 7.9.0 or later.

Fix

Incorrect Authorization

Incorrect Permission

Weakness Enumeration

CWE-863

CWE-732

Related Identifiers

CVE-2025-8148

Affected Products

Goanywhere Mft

References · 6

• https://osv.dev/vulnerability/CVE-2025-8148 · Vendor Advisory
• https://fortra.com/security/advisories/product-security/fi-2025-013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8148 · Security Note
• https://t.me/CVEtracker/38965 · Telegram Post
• https://t.me/cveNotify/150422 · Telegram Post
• https://twitter.com/CVEnew/status/1997052256739266856 · Twitter Post