CVE-2025-0049: 
GoAnywhere MFT vulnerability analysis and mitigation

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere versions before 7.8.0. The vulnerability was discovered on August 2, 2023, and publicly disclosed on April 28, 2025 (Fortra Advisory, NVD).

The vulnerability is classified as CWE-209 (Generation of Error Message Containing Sensitive Information). It has been assigned a CVSS v3.1 base score of 3.5 LOW by Fortra (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) and 4.3 MEDIUM by NIST (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The issue occurs specifically when a Web User without Create permission attempts to upload a file to a non-existent directory, resulting in an error message that exposes the absolute server path (Fortra Advisory).

The vulnerability allows potential attackers to gain knowledge of the server's file system structure through the exposed absolute path information in error messages. This information disclosure could be used for application mapping and potentially assist in further attack planning (Fortra Advisory).

The primary mitigation is to upgrade to GoAnywhere version 7.8.0 or later. As a workaround, administrators can grant Create permission on Subfolders to Web Users, as this permission would automatically create non-existent directories during upload attempts, preventing the error message from occurring (Fortra Advisory).