CVE-2025-0049: Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0
When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0049?
CVE-2025-0049 is considered a medium severity vulnerability due to the potential information disclosure it allows.
How do I fix CVE-2025-0049?
To fix CVE-2025-0049, upgrade GoAnywhere to version 7.8.0 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2025-0049?
CVE-2025-0049 is an information disclosure vulnerability that exposes the server's absolute path in error messages.
Who is affected by CVE-2025-0049?
CVE-2025-0049 affects users of HelpSystems GoAnywhere versions prior to 7.8.0.
What action should a web user take regarding CVE-2025-0049?
Web users should ensure they do not upload files to non-existent directories and should update to the latest software version.