EUVD-2026-42379
GHSA-qp89-5wp8-rj83
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach MOVEit admin web interface
-
DeliverySend Admin Settings request with ../ sequences
-
ExploitEscape directory via CWE-23 traversal
-
ExecutionRead files outside web root
-
ImpactExfiltrate configuration secrets or sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Relative path traversal prevention
|
| Exploitation Conditions | The attacker must be able to reach the MOVEit Transfer web application's Admin Settings module and inject relative traversal sequences into the vulnerable path-handling parameter; NVD's PR:N implies no authentication is required, but the flaw's location in the Admin Settings module strongly suggests an administrative context, so treat 'unauthenticated reachability' as unconfirmed and verify with Progress. Limiting factors: only instances running versions before 2025.0.7 or 2025.1.0-2025.1.2 are vulnerable; impact is limited to reading files (confidentiality only - no write, no code execution, no availability loss); and exposure drops sharply if the admin interface is not reachable from untrusted networks. No user interaction is required (UI:N) and complexity is low (AC:L). |
| Impact | The signals are largely consistent and point to moderate rather than urgent priority. CVSS 7.5 is driven by an easy network vector (AV:N/AC:L/PR:N/UI:N) but capped by confidentiality-only impact with no integrity or availability effect. Corroborating lower urgency: EPSS is only 0.20% (10th percentile), CISA SSVC records Exploitation=none, Automatable=no and Technical Impact=partial, and the CVE is not on the CISA KEV list. One notable tension: NVD asserts PR:N (unauthenticated) while the vulnerability lives in the 'Admin Settings' module, which normally implies an authenticated administrative context - verify with the vendor whether the vulnerable endpoint is reachable pre-authentication, because that single fact materially changes real-world exposure. Given MOVEit's history as a mass-exploitation target (CVE-2023-34362), defenders should still patch promptly despite the currently low exploitation signals. |
| Exploit ScenarioDerived | An attacker who can reach the MOVEit Transfer administration web interface sends a crafted request to an Admin Settings endpoint containing relative path traversal sequences (e.g., '../../') to escape the intended directory and read arbitrary files such as configuration files or stored secrets. Because AC:L and no user interaction are required, the request is trivial to automate against a reachable instance; no public exploit is identified at this time, and if the endpoint truly requires admin authentication the attacker must first obtain valid credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 09, 2026
Path traversal in Progress MOVEit Transfer's Admin Settings module (versions before 2025.0.7 and 2025.1.0 before 2025.1.3) lets remote attackers supply relative '../' sequences to read files outside the intended directory, exposing sensitive configuration or system data. The CVSS 3.1 vector scores it 7.5 with confidentiality-only impact (C:H/I:N/A:N) and no listed authentication (PR:N), though the 'Admin Settings' location warrants scrutiny of that claim. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and CISA SSVC records no known exploitation.
Earlier versions of this analysis (2)
Information disclosure via relative path traversal in Progress MOVEit Transfer's Admin Settings module allows remote unauthenticated attackers to read files outside the intended directory on affected 2025.0.x (before 2025.0.7) and 2025.1.x (before 2025.1.3) builds. The flaw yields high confidentiality impact with no integrity or availability effect, and while a vendor patch is available, there is no public exploit identified at time of analysis and CISA's SSVC scores exploitation as none. EPSS is low (0.20%, 10th percentile), suggesting no near-term mass-exploitation pressure despite MOVEit's history as a high-value ransomware target.
Path traversal in Progress MOVEit Transfer's Admin Settings module allows authenticated administrators to read arbitrary files outside their intended directory scope by supplying relative path sequences. Affecting all releases before 2025.0.7 and the 2025.1.x branch before 2025.1.3, the flaw is constrained by its adjacent-network attack vector and high-privilege requirement, yielding a moderate CVSS base score of 4.5. No public exploit code has been identified and this vulnerability does not appear in CISA KEV, though MOVEit Transfer's history as a high-value ransomware target makes any flaw in this product worthy of prompt remediation.
RemediationAI
Patch available per vendor advisory: upgrade MOVEit Transfer to 2025.0.7 or later on the 2025.0.x branch, or to 2025.1.3 or later on the 2025.1.x branch, as documented in the Progress fixed-issues release notes (https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html). Until patching is complete, restrict network access to the MOVEit administration interface by binding or firewalling the Admin Settings/console endpoints to trusted management IP ranges or a VPN rather than exposing them to the internet, accepting that remote administrators must then connect through that restricted path; place the application behind a WAF with path-traversal (raw and encoded '../') filtering, noting such rules can be bypassed and should not be treated as a complete fix; and monitor web logs for traversal patterns against Admin Settings URLs. Confirm with Progress support whether the vulnerable endpoint requires authentication before relying on access controls as the primary mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MOVEit Transfer is Progress Software's managed file transfer (MFT) platform used to move sensitive business data over HTTPS, SFTP and FTPS with a web-based administration console. The flaw is CWE-23 (Relative Path Traversal), the class where user-supplied input containing '../' sequences is used to build a filesystem path without proper canonicalization or containment, permitting access outside the intended base directory. Here the weakness resides specifically in the Admin Settings module of the web application, and the confidentiality-only impact (C:H, I:N, A:N) indicates the traversal enables unauthorized file reads rather than writes or code execution. CPE data confirms the affected product as cpe:2.3:a:progress:moveit_transfer across the listed version ranges.
Know when Progress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable admin module implies at least low-privilege authentication (PR:L over NVD's PR:N); confidentiality-only file read yields C:H, I:N, A:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
Executive ViewAI
Progress MOVEit Transfer (versions before 2025.0.7 and 2025.1.3) contains a path traversal vulnerability in the Admin Settings module that allows unauthenticated remote attackers to read sensitive configuration files and system data. Affected organizations risk exposure of administrative credentials, database connection strings, and other sensitive operational information that could enable further system compromise. This HIGH severity vulnerability requires immediate patching despite low current exploitation likelihood (EPSS 0.2%).
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary s
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization v
SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute ar
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
Unauthenticated remote code execution affects Progress ShareFile Storage Zones Controller versions up to 5.12.3 via unau
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injec
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to r
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh
Exploit-DB