Vulnerability · Published Apr 28, 2025 · Assigned by Fortra
CVE-2025-0049Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0
Low 3.5
In plain English
A low-severity security flaw in GoAnywhere from Fortra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.3%top 80.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortra | GoAnywhere | 0 – before 7.8 |
Weakness: CWE-209 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N