Unrated severityNVD Advisory· Published Dec 5, 2025· Updated Dec 5, 2025
CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT
CVE-2025-8148
Description
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
Affected products
2- Range: <7.9.0
- Fortra/GoAnywhere MFTv5Range: 0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.