Unrated severityNVD Advisory· Published Dec 5, 2025· Updated Dec 5, 2025

CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT

CVE-2025-8148

Description

An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.

Affected products

Fortra/GoAnywhere MFTllm-fuzzy2 versions
<7.9.0+ 1 more
- (no CPE)range: <7.9.0
- (no CPE)range: 0

Patches

Vulnerability mechanics

References

www.fortra.com/security/advisories/product-security/fi-2025-013mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000