Path traversal in Fortra GoAnywhere MFT enables arbitrary file read

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.

• Fortra GoAnywhere MFT: the default status is unaffected, but versions from 0 through less than 7.10.2 are marked affected using semver.
• The affected data identifies Secure Mail, Secure Folders, and File System as relevant modules. Exploitation requires a Web User with both Secure Folders and Secure Mail permissions.
• Fortra states that MFT as a Service customers are protected from exploitation through security controls in the environment.
• The record and vendor guidance identify 7.10.2 as the remediated version. The status of separate parallel release branches is not described independently.

Fortra GoAnywhere MFT handles paths unsafely at the /attachRemoteFiles endpoint, creating a relative path traversal weakness classified as CWE-23. An authenticated Web User with both Secure Folders and Secure Mail permissions can provide a path that causes file resolution to escape the user's sandboxed home directory. The result is arbitrary file read within the permissions available to the service process, rather than access limited to the user's sandbox. The described access is network reachable, requires low privileges, does not require additional user interaction, and has low attack complexity. The record does not identify the request parameter, path encoding, canonicalization logic, or detailed filesystem conditions involved.

The affected endpoint is reachable over the network. Exploitation requires a Web User account with both Secure Folders and Secure Mail permissions; no additional user interaction is required and the described attack complexity is low. The supplied record does not confirm exploitation in the wild and does not identify a public exploit. Fortra states that MFT as a Service customers are protected from exploitation through security controls in the environment.

The vulnerability allows an eligible Web User to read files outside the sandboxed home directory through /attachRemoteFiles. Because the access crosses the user's intended boundary, files belonging to other data areas may be exposed if they are readable by the service process. The primary consequence is loss of confidentiality and potentially weakened separation between users or service areas. The record does not establish file modification, code execution, or service disruption, and it does not confirm that exploitation has occurred.

• Data exposure: An eligible Web User may read files outside the assigned home directory, potentially exposing sensitive information that the account should not access.
• Broken user or tenant isolation: Escaping the sandbox may weaken separation between users, directories, or data areas when those files are readable by the service process.
• Impact limits: The record confirms file disclosure only. It does not establish that the flaw permits file modification or deletion, or that it can interrupt service availability.
• Fortra states that MFT as a Service customers are protected from exploitation through security controls in the service environment.

1. Upgrade Fortra GoAnywhere MFT to remediated version 7.10.2 or later, as directed by Fortra.
2. Before upgrading, inventory GoAnywhere MFT servers and services, installed versions, relevant modules, and deployment models so that affected branches are not missed.
3. Identify Web User accounts with both Secure Folders and Secure Mail permissions. After updating, verify that those accounts and /attachRemoteFiles operate within the intended access boundary.
4. Review relevant audit and application logs for historical /attachRemoteFiles activity or file reads outside sandboxed home directories. Treat this as an investigative supplement, not a substitute for upgrading.
5. If using MFT as a Service, confirm with the provider that the environment is covered by the security controls Fortra describes as protecting customers from exploitation.

• Inventory all Fortra GoAnywhere MFT deployments, deployment models, and running versions, then compare them with the affected boundary in affected_summary.
• Identify Web User accounts that have both Secure Folders and Secure Mail permissions, especially on systems where /attachRemoteFiles is reachable.
• Review available request, application, and audit logs for activity involving /attachRemoteFiles and file reads outside a user's sandboxed home directory. Treat this as a precautionary review because the advisory does not name specific log fields or indicators.
• Examine historical file access by accounts meeting the permission requirement for unexpected reads outside their permitted sandbox.
• Do not treat the absence of matching log evidence as proof of safety; verify the installed version and remediation status separately.