EUVD-2026-42385
GHSA-g7h5-mc2v-rvpm
Vulnerability Assessment
| Weakness |
CWE
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 09, 2026
Path-equivalence weakness in Progress MOVEit Transfer's File Upload modules lets remote attackers bypass path-normalization checks to reach or place files outside their intended scope, carrying an NVD CVSS of 9.8. It affects MOVEit Transfer before 2025.0.8 and the 2025.1.x line before 2025.1.4, and a vendor patch is available. There is no public exploit identified at time of analysis and EPSS is low (0.25%), while CISA SSVC rates exploitation as none and technical impact as only partial.
Earlier versions of this analysis (2)
Path-equivalence handling in Progress MOVEit Transfer's File Upload modules lets remote unauthenticated attackers bypass path validation to compromise confidentiality, integrity, and availability of the managed-file-transfer server. The flaw carries a CVSS 9.8 with a fully network-reachable, no-privilege vector and affects MOVEit Transfer before 2025.0.8 and the 2025.1.x branch before 2025.1.4. There is no public exploit identified at time of analysis and CISA SSVC currently rates exploitation as none, but MOVEit's history as a mass-exploitation target (Cl0p 2023) makes prompt patching prudent.
Path equivalence manipulation in Progress MOVEit Transfer's file upload modules allows an authenticated low-privileged user to store files in unintended server-side locations by crafting filenames with equivalent path representations (CWE-46). Affected versions span the 2025.0.x branch before 2025.0.8 and the 2025.1.x branch before 2025.1.4. Impact is limited to low integrity loss with no confidentiality or availability consequences; no public exploit or active exploitation has been identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Progress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Low-privilege authentication and user interaction are required; only limited file integrity impact applies with no confidentiality or availability loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules).
This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.
Executive ViewAI
A critical file transfer vulnerability in Progress MOVEit Transfer (CVE-2026-8801, CVSS 9.8) enables attackers to bypass directory restrictions and access or inject files outside protected scopes, potentially exposing confidential data and corrupting file transfers. Organizations using MOVEit Transfer face significant risk to the integrity and confidentiality of sensitive documents and data exchanges. An immediate vendor patch deployment is required to restore secure file transfer operations.
Within 24 hours: Identify all Progress MOVEit Transfer instances and document current version numbers. Within 7 days: Apply vendor patches-upgrade installations running versions prior to 2025.0.8 to the latest 2025.0.x release, and upgrade 2025.1.x installations to version 2025.1.4 or later. Within 30 days: Confirm successful patch deployment across all instances, audit file access and upload logs for unauthorized activity, and validate normal file transfer operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary s
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization v
SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute ar
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
Unauthenticated remote code execution affects Progress ShareFile Storage Zones Controller versions up to 5.12.3 via unau
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injec
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to r
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh
Exploit-DB