EUVD-2026-42370
GHSA-jh92-gc65-pg86
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Custom Reports endpoint is reachable without authentication or user interaction and query injection yields total data confidentiality, integrity, and availability impact, so PR:N/UI:N/AC:L and C/I/A:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
10DescriptionNVD
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).
This issue affects MOVEit Transfer: before 2026.0.0, before 2025.1.3, before 2025.0.7.
AnalysisAI
SQL/NoSQL query injection in Progress MOVEit Transfer (Custom Reports modules) lets remote unauthenticated attackers manipulate backend data-query logic to read, alter, or destroy managed-file-transfer data across versions before 2025.0.7, 2025.1.3, and 2026.0.0. Rated CVSS 9.8 with full confidentiality, integrity, and availability impact, though real-world exploitation is currently rated low (EPSS 0.22%, CISA SSVC exploitation 'none') and no public exploit has been identified at time of analysis. MOVEit's history as a mass-exploitation target (Cl0p, 2023) makes this a high-priority patch despite the currently quiet threat signal.
Technical ContextAI
MOVEit Transfer is a widely deployed enterprise managed file transfer (MFT) platform used to exchange sensitive files between organizations, frequently internet-facing. The flaw resides in the Custom Reports modules and is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic), the parent class covering both SQL and NoSQL injection; vendor tags specifically cite 'Nosql Injection' and 'Information Disclosure.' Because report-generation logic constructs data queries from attacker-influenced input without proper neutralization, crafted input can break out of the intended query structure and change its meaning. The single CPE cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:* confirms the affected product is the MOVEit Transfer application across all sub-versions below the fixed builds.
RemediationAI
Apply the vendor patch by upgrading to a fixed build: MOVEit Transfer 2025.0.7 for the 2025.0.x branch, 2025.1.3 for the 2025.1.x branch, or 2026.0.0, per Progress's Fixed Issues release notes at https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html. Patch status: patch available per vendor advisory. If immediate patching is not possible, reduce exposure by restricting or disabling access to the Custom Reports functionality for untrusted users, placing the MOVEit web interface behind a VPN or IP allowlist to remove unauthenticated internet reachability, and enabling WAF rules to filter query-injection patterns against report endpoints - noting these controls may disrupt legitimate reporting workflows and remote partner access and are stopgaps only. Given MOVEit's history, also monitor logs for anomalous report queries and review data-access audit trails.
More in Moveit Transfer
View allIn Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.0.0 be
In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.
Path-equivalence weakness in Progress MOVEit Transfer's File Upload modules lets remote attackers bypass path-normalizat
Session-handling weakness in Progress MOVEit Transfer (all builds before 2025.1.5, and 2026.0.0 before 2026.0.3) leaves
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Authentication bypass in Progress MOVEit Transfer (versions before 2025.1.5, and 2026.0.0 before 2026.0.3) lets remote u
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.0.0 bef
In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web appl
In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in w
In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today