UpHeron
All vulnerabilities

Servers and applications

CVE-2025-8148

An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.

Severity
Medium 4.2
Published
5 Dec 2025
Last changed
25 Sept 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.9.0
Sources
NVD

Affected software

SoftwareAffected versions
GoAnywhere MFTServers and applications · cpe:a:fortra:goanywhere_managed_file_transfer
  • Every version before 7.9.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-8148
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-8148