Vulnerability · Published Dec 5, 2025 · Assigned by Fortra
CVE-2025-8148CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT
Medium 4.2
In plain English
A medium-severity incorrect permission assignment in GoAnywhere MFT from Fortra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.2%top 92.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortra | GoAnywhere MFT | 0 – before 7.9.0 |
Weakness: CWE-732, CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N