Fortra GoAnywhere Managed File Transfer (MFT) < 7.10.2 Path Traversal (CVE-2026-15913)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346899);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id("CVE-2026-15913");

  script_name(english:"Fortra GoAnywhere Managed File Transfer (MFT) < 7.10.2 Path Traversal (CVE-2026-15913)");

  script_set_attribute(attribute:"synopsis", value:
"A web application running on the remote server is affected by a path traversal vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of Fortra GoAnywhere Managed File Transfer (MFT) running on the
remote host is prior to 7.10.2. It is, therefore, affected by a path traversal vulnerability in the /attachRemoteFiles
endpoint which allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home
directory, achieving arbitrary file read.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.fortra.com/security/advisories/product-security/fi-2026-011
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e72d7a1d");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Fortra GoAnywhere Managed File Transfer (MFT) 7.10.2 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-15913");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/17");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:helpsystems:goanywhere_managed_file_transfer");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:fortra:goanywhere_managed_file_transfer");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("fortra_goanywhere_mft_web_detect.nbin", "fortra_goanywhere_win_installed.nbin");
  script_require_keys("installed_sw/Fortra GoAnywhere MFT");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Fortra GoAnywhere MFT', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '7.10.2'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);