{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-0972 GoAnywhere MFT",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SBA Research Security Advisory via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n# GoAnywhere MFT Email HTML Injection #\n\nLink: https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251120-01_GoAnywhere_MFT_Email_HTML_Injection\n\n## Vulnerability Overview ##\n\nGoAnywhere MFT before 7.10.0 is affected by an HTML injection vulnerability\nin its email templating functionality. If an attacker is able to influence\nthe content of a template variable, malicious HTML can be embedded into\noutgoing emails generated by the application. As these messages originate\nfrom a trusted system, the vulnerability may facilitate phishing and other\nsocial-engineering attacks. The issue arises from insufficient HTML encoding\nof untrusted input before inclusion in HTML email content.\n\n* **Identifier**            : SBA-ADV-20251120-01\n* **Type of Vulnerability** : HTML Injection\n* **Software/Product Name** : [GoAnywhere MFT](https://www.goanywhere.com/products/goanywhere-mft)\n* **Vendor**                : [Fortra](https://www.fortra.com/)\n* **Affected Versions**     : \u003c= 7.9.1\n* **Fixed in Version**      : 7.10.0\n* **CVE ID**                : CVE-2026-0972\n* **CVSS Vector**           : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n* **CVSS Base Score**       : 5.4 (Medium)\n\n## Vendor Description ##\n\nGoAnywhere Managed File Transfer is a comprehensive managed file transfer\nsolution that will manage your organization\u2019s file transfer software,\nfile sharing, secure FTP, and automation needs through a single interface.\n\n\nSource: \u003chttps://www.goanywhere.com/products/goanywhere-mft\u003e\n\n## Impact ##\n\nAttackers can abuse the email templating functionality by injecting\nmalicious content into template variables, resulting in HTML injection in\noutgoing emails.\n\n## Vulnerability Description ##\n\nIt is possible to manipulate HTML emails generated via the \"Send Email\"\nfunctionality if an attacker is able to control the content of a template\nvariable. User-supplied data inserted into the email body is not properly\nHTML-encoded, and there is no option to enforce encoding for variables\nduring email template configuration.\n\n![Send Email Configuration](images/send_email_configuration.png)\n\nAs a result, an attacker can inject arbitrary HTML content into outgoing\nemails. Since these emails are sent by the legitimate mail server and\ntherefore appear to originate from a trusted sender, recipients are more\nlikely to trust their contents. An attacker could, for example, insert links\nthat redirect users to a phishing website designed to capture credentials\nor other sensitive information, or to deliver further malicious content.\n\nThis vulnerability can therefore be used to conduct effective phishing or\nsocial engineering attacks leveraging the trust relationship between the\napplication and its users.\n\n## Proof of Concept ##\n\n1. Configure an \"Upload Successful\" trigger: Set up an automation rule or\nworkflow that is triggered whenever a user uploads a file in the application\n[1]. This trigger should fire on each successful upload and proceed to\nexecute the subsequent action.\n\n2. Attach the \"Send Email\" functionality to the trigger: Add a \"Send\nEmail\" action that is executed whenever the \"Upload Successful\" trigger\nfires. Configure this action to send an HTML email to an internal recipient\n(for example, a support or operations mailbox) to notify them that a new\nfile has been uploaded. [2]\n\n3. Include the uploaded filename as a variable in the email template:\nIn the HTML email template, insert the variable representing the uploaded\nfilename into the email body, for example: A new file has been uploaded:\n${VARIABLE_NAME}. The email will then be sent automatically to the internal\nrecipient whenever a file is uploaded.\n\n4. Upload a file with HTML special characters in the filename: Upload a file\nwhose filename contains HTML markup instead of a normal, benign filename. For\ninstance:\n`Please enter your password here: \u003ca href=\u0027evil.site\u0027\u003eevil.site\u003ca\u003e.jpg`.\nBecause the filename is treated as data but inserted directly into\nthe HTML email without encoding, the HTML tags are preserved as-is.\n\n5. Observe the manipulated HTML content in the received confirmation\nemail: When the internal recipient receives the confirmation email, the\nfilename variable will be rendered as part of the HTML content. Instead of\ndisplaying the raw text of the filename, the email client interprets the\ninjected HTML: the phishing link appears as a clickable hyperlink. This\ndemonstrates that attacker-controlled input can manipulate the structure\nand content of outgoing HTML emails, enabling the injection of malicious\nlinks and other HTML elements into messages that appear to come from a\ntrusted internal system.\n\n## Recommended Countermeasures ##\n\nWe recommend updating to GoAnywhere MFT version 7.10.0 or later.\n\nGoAnywhere MFT should not allow unencoded HTML special characters from\nuser provided sources in email output and instead apply correct encoding\naccording to the output context. For example, when displaying the content\nwithin an HTML email, HTML encoding must be performed before the untrusted\ndata is displayed.\n\n## Timeline ##\n\n* `2025-10-19` Identified the vulnerability in version 7.8.3 Build 7\n* `2025-12-01` First contact with Fortra support team\n* `2025-12-12` Disclosed vulnerability to Fortra support team and started\n               our 90 day disclosure timeline\n* `2026-01-20` Vulnerability was assigned CVE-2026-0972 by Fortra\n* `2026-03-18` Disclosure timeline extended due to promised fix\n               with release 7.10 at the end of March\n* `2026-04-07` Disclosure timeline extended again due to delayed release\n* `2026-04-20` Fortra published a fix with release 7.10\n* `2026-04-23` Public disclosure\n\n## References ##\n\n1. GoAnywhere MFT Triggers:\n   \u003chttps://www.goanywhere.com/products/goanywhere-mft/automation/triggers\u003e\n2. GoAnywhere MFT Email Connectivity:\n   \u003chttps://www.goanywhere.com/products/goanywhere-mft/connectivity/email\u003e\n3. Vendor Security Advisory:\n   \u003chttps://www.fortra.com/security/advisories/product-security/fi-2026-006\u003e\n\n## Credits ##\n\n* Philipp Schweinzer ([SBA Research](https://www.sba-research.org/))\n\nThe discovery of this vulnerability was made possible through support from\n[CYSSDE](https://cyssde.eu/) and the European Union.\n\n![CYSSDE](images/cyssde.png)\n-----BEGIN PGP SIGNATURE-----\n\niQJPBAEBCAA5FiEEL9Wp/yZWFD9OpIt6+7iGL1j3dbIFAmnqfbcbFIAAAAAABAAO\nbWFudTIsMi41KzEuMTIsMiwxAAoJEPu4hi9Y93WyzUwP/R71yiNhsJF2yZMNqxEx\nwPSH2FKSSMC2AU+nV7ukYpbfK0APhq/8NLOXG6jXpmXH1F5pmWvoPdVQeGQinqef\ndGH19oe7Wd+lhBEK5icO10L6NNEGyxy+gev21Kbykf6+wrMzJz+ICjpyMBdi/4zV\nYaiIlprrtCtTylSTBUMV9fXqcj1HKWWtWTDObXI9JgvGh4IfYzNrV6AgfGv6GvIJ\ngSKHSmVvCmd1WWQMA/JiuEBCpgCeJIXcApKK+vuxmduh4fGRnpcWc0LxCb82ny+O\n/qOdYOt+nSvwEttVBARYS1d+uMYfLiiWYNZD3g84o8VAaelR9AT9NeCkOUPhEGAd\nxbM9A+Y46HqdPt0mJQ81bPi938r6Xruvg3rAw4JoQSV8/VCtzWmicIiLsVZJNRdb\nCVDgCX8tg8gpMlzcssmnNUrpsBolb3ovxiBVj1SXfi1c/ln6FWbvnnjNYBmkWPSg\nQUK/m7ZgKFuNCqf6z8gBK7jOtK2Bv7OiMZ4s+gVEuNRYFFZOoQn9DtnWgAUcSbI5\n3l0I56qPNgWqWUG3AwnP6P24x/6qjOn3jyLo5CKONd1NeGyIe1XL44Xh6I2B5hou\nC4qkUGB67wNS/wQwDUuEdlo62TLGnd48N9dG8VGzw+AI9DBR0DXjFvvlLfz5cQ5q\nxg2FGsgh2xDnCa3KBno+0HOr\n=2+hu\n-----END PGP SIGNATURE-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:29Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/8"
        },
        {
          "url": "https://cyssde.eu/"
        },
        {
          "url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251120-01_GoAnywhere_MFT_Email_HTML_Injection"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.fortra.com/"
        },
        {
          "url": "https://www.fortra.com/security/advisories/product-security/fi-2026-006"
        },
        {
          "url": "https://www.goanywhere.com/products/goanywhere-mft"
        },
        {
          "url": "https://www.goanywhere.com/products/goanywhere-mft/automation/triggers"
        },
        {
          "url": "https://www.goanywhere.com/products/goanywhere-mft/connectivity/email"
        },
        {
          "url": "https://www.sba-research.org/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SBA-ADV-20251120-01] CVE-2026-0972: GoAnywhere MFT Email HTML Injection",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-0972",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0247",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/8",
            "automated": true,
            "contentSha256": "b86c1665c4c67e4fa72469aea279d0ddfbbe325fcd127bedbc4c583f89905d93",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-23T20:15:13Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0247"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-09T10:09:29Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0247"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}