An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
References
| Link | Resource |
|---|---|
| https://www.fortra.com/security/advisories/product-security/fi-2025-013 | Vendor Advisory |
Configurations
History
30 Jan 2026, 16:52
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Fortra
Fortra goanywhere Managed File Transfer |
|
| CPE | cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:* | |
| References | () https://www.fortra.com/security/advisories/product-security/fi-2025-013 - Vendor Advisory |
05 Dec 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-05 21:15
Updated : 2026-01-30 16:52
NVD link : CVE-2025-8148
Mitre link : CVE-2025-8148
CVE.ORG link : CVE-2025-8148
JSON object : View
Products Affected
fortra
- goanywhere_managed_file_transfer