CVE-2025-0049

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published: Apr 28, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-00505.9Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valha CVE-2025-00518.7Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service.CVE-2025-00528.3Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service.CVE-2025-00535.3SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a CVE-2025-00545.4SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The CVE-2025-00556.0SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administrati CVE-2025-00566.0SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�CVE-2025-00574.8SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin ca CVE-2025-00586.5In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource CVE-2025-00596.0Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usa CVE-2025-00606.5SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can CVE-2025-00619.1SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without