EUVD-2026-42379
GHSA-qp89-5wp8-rj83
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable admin module implies at least low-privilege authentication (PR:L over NVD's PR:N); confidentiality-only file read yields C:H, I:N, A:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
AnalysisAI
Path traversal in Progress MOVEit Transfer's Admin Settings module (versions before 2025.0.7 and 2025.1.0 before 2025.1.3) lets remote attackers supply relative '../' sequences to read files outside the intended directory, exposing sensitive configuration or system data. The CVSS 3.1 vector scores it 7.5 with confidentiality-only impact (C:H/I:N/A:N) and no listed authentication (PR:N), though the 'Admin Settings' location warrants scrutiny of that claim. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and CISA SSVC records no known exploitation.
Technical ContextAI
MOVEit Transfer is Progress Software's managed file transfer (MFT) platform used to move sensitive business data over HTTPS, SFTP and FTPS with a web-based administration console. The flaw is CWE-23 (Relative Path Traversal), the class where user-supplied input containing '../' sequences is used to build a filesystem path without proper canonicalization or containment, permitting access outside the intended base directory. Here the weakness resides specifically in the Admin Settings module of the web application, and the confidentiality-only impact (C:H, I:N, A:N) indicates the traversal enables unauthorized file reads rather than writes or code execution. CPE data confirms the affected product as cpe:2.3:a:progress:moveit_transfer across the listed version ranges.
RemediationAI
Patch available per vendor advisory: upgrade MOVEit Transfer to 2025.0.7 or later on the 2025.0.x branch, or to 2025.1.3 or later on the 2025.1.x branch, as documented in the Progress fixed-issues release notes (https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html). Until patching is complete, restrict network access to the MOVEit administration interface by binding or firewalling the Admin Settings/console endpoints to trusted management IP ranges or a VPN rather than exposing them to the internet, accepting that remote administrators must then connect through that restricted path; place the application behind a WAF with path-traversal (raw and encoded '../') filtering, noting such rules can be bypassed and should not be treated as a complete fix; and monitor web logs for traversal patterns against Admin Settings URLs. Confirm with Progress support whether the vulnerable endpoint requires authentication before relying on access controls as the primary mitigation.
More in Moveit Transfer
View allIn Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.0.0 be
In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.
Path-equivalence weakness in Progress MOVEit Transfer's File Upload modules lets remote attackers bypass path-normalizat
Session-handling weakness in Progress MOVEit Transfer (all builds before 2025.1.5, and 2026.0.0 before 2026.0.3) leaves
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Authentication bypass in Progress MOVEit Transfer (versions before 2025.1.5, and 2026.0.0 before 2026.0.3) lets remote u
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.0.0 bef
In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web appl
In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in w
In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today