CVE-2026-15913: 
GoAnywhere MFT vulnerability analysis and mitigation

CVE-2026-15913 is a relative path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT that allows authenticated Web Users to escape their sandboxed home directory and achieve arbitrary file read. It affects all versions of GoAnywhere MFT prior to 7.10.2. The vulnerability was published on September 9, 2026, with a patch advisory (FI-2026-011) released by Fortra. It carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, Fortra Advisory).

The vulnerability is classified as CWE-23 (Relative Path Traversal), where the /attachRemoteFiles endpoint fails to properly neutralize path sequences (e.g., ../) in user-supplied input, allowing directory traversal outside the intended sandboxed home directory. Exploitation requires an authenticated Web User account that holds both Secure Folders and Secure Mail permissions — a specific combination that enables access to the vulnerable endpoint. The attack is network-based, requires low privileges, no user interaction, and has low complexity, with the scope change indicating that files outside the user's security boundary can be accessed (GitHub Advisory, Fortra Advisory).

Successful exploitation allows an authenticated attacker to read arbitrary files on the GoAnywhere MFT server beyond their designated sandbox directory, resulting in a high confidentiality impact. Sensitive data such as configuration files, credentials, private keys, or other users' managed file transfer data could be exposed. There is no integrity or availability impact, but file disclosure could facilitate further attacks or lateral movement within the environment (GitHub Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The NVD SSVC assessment confirms exploitation status as "none" and notes the attack is not automatable due to the specific permission preconditions required. The EPSS score is approximately 0.39%, placing it in the 33rd percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A Nessus detection plugin (ID 346899) is available for scanning (Tenable).

1. Reconnaissance: Identify GoAnywhere MFT instances running versions prior to 7.10.2 using network scanning tools or Shodan. Confirm the target is accessible over the network.
2. Obtain credentials: Acquire or use existing credentials for a Web User account that has both Secure Folders and Secure Mail permissions enabled — the specific permission combination required to access the /attachRemoteFiles endpoint.
3. Authenticate: Log in to the GoAnywhere MFT web interface using the obtained credentials.
4. Craft traversal request: Send a crafted HTTP request to the /attachRemoteFiles endpoint, embedding relative path traversal sequences (e.g., ../../etc/passwd or ../../conf/goanywhere.properties) in the file path parameter to escape the sandboxed home directory.
5. Read arbitrary files: The server processes the traversal sequence without proper sanitization, returning the contents of the targeted file outside the user's sandbox, enabling disclosure of sensitive system or application files (GitHub Advisory, Fortra Advisory).

• Network: Unusual or repeated HTTP requests to the /attachRemoteFiles endpoint containing path traversal sequences such as ../, %2e%2e%2f, or ..%2f in request parameters.
• Logs: GoAnywhere MFT access logs showing requests to /attachRemoteFiles with file paths referencing directories outside the user's home/sandbox directory; repeated access attempts from a single authenticated user account targeting system-level file paths.
• File System: Evidence of access to sensitive files (e.g., configuration files, key stores, credential files) that would not normally be accessed by Web Users via the MFT interface.
• Process/Application: Audit log entries in GoAnywhere MFT showing file read operations by Web Users with Secure Folders and Secure Mail permissions accessing paths inconsistent with their assigned home directory.

Fortra has released GoAnywhere MFT version 7.10.2 which addresses this vulnerability; upgrading to 7.10.2 or later is the recommended remediation (Fortra Advisory). As a workaround, administrators should review and restrict Secure Folders and Secure Mail permissions, granting both only to users who strictly require them, thereby reducing the attack surface. Additionally, monitoring the /attachRemoteFiles endpoint in access logs for suspicious path traversal patterns can help detect exploitation attempts.

The vulnerability received brief coverage on security aggregation platforms and social media shortly after disclosure, including mentions on Mastodon via TheHackerWire and coverage in the "Security Signal Weekly" blog for the week of September 5–11, 2026. No significant vendor statements beyond the Fortra advisory or notable independent researcher commentary have been identified at this time.