What is CVE-2026-15913?

CVE-2026-15913 is a high-severity vulnerability in Fortra Goanywhere Mft, classified under Relative Path Traversal. CVSS score: 7.7/10. Published 2026-09-09.

How severe is CVE-2026-15913?

High severity. CVSS v3 base score is 7.7 out of 10.

Path Traversal in Fortra Goanywhere Mft

CVE-2026-15913

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

Affected products

Fortra Goanywhere Mft

Weakness classification (CWE)

CWE-23 — Relative Path Traversal

References

df4dee71-de3a-4139-9588-11b62fe6c0ff (vendor-advisory)

Frequently asked questions

What is CVE-2026-15913?: CVE-2026-15913 is a high-severity vulnerability in Fortra Goanywhere Mft, classified under Relative Path Traversal. CVSS score: 7.7/10. Published 2026-09-09.
How severe is CVE-2026-15913?: High severity. CVSS v3 base score is 7.7 out of 10.