CVE-2026-8801: Path Equivalence in Progress MOVEit Transfer File Upload

Technical summary

CVE-2026-8801 is a path equivalence flaw (CWE-46) in Progress MOVEit Transfer's file upload handling. The vulnerability allows an authenticated user to bypass path validation controls by submitting specially crafted file paths that are logically equivalent but not caught by the application's validation logic. This could enable modification of files outside intended directories or overwriting of protected resources. The CVSS 3.1 score of 3.5 (LOW severity) reflects the requirement for prior authentication, user interaction, and limited scope of impact (integrity only).

Business impact

The primary business risk is unintended file modification within MOVEit Transfer environments. Since the vulnerability requires authenticated access and user interaction, the attack surface is constrained to legitimate users or accounts that have been compromised. For organizations relying on MOVEit Transfer for secure file exchange, this could result in data integrity concerns, compliance audit findings, or potential lateral movement vectors if an attacker exploits the flaw to plant malicious content. The low CVSS score should not lead to deprioritization if your organization depends heavily on file integrity assurances or operates in regulated industries.

Affected systems

Affected versions: Progress MOVEit Transfer versions before 2025.0.8, and all 2025.1.x versions before 2025.1.4. Organizations should audit their deployed version numbers immediately. The vulnerability does not affect earlier major versions (e.g., 2024.x series or earlier), so version inventory is the critical first step.

Exploitability

Exploitation requires valid authentication credentials and user interaction, significantly limiting real-world attack probability. An attacker would need to be either an insider, a compromised legitimate account, or have obtained valid credentials through phishing or other means. The barrier to casual exploitation is high, but the flaw could be weaponized by a sophisticated adversary with persistent access or as part of a multi-stage compromise. Current public information does not indicate active exploitation.

Remediation

Upgrade MOVEit Transfer to version 2025.0.8 or later (for 2025.0.x branch), or version 2025.1.4 or later (for 2025.1.x branch). Verify with Progress vendor advisories that the patch version you deploy actually contains the fix. If immediate patching is not feasible, implement compensating controls such as audit logging on file upload operations, restrictive access controls on user accounts with upload privileges, and network segmentation to limit account compromise blast radius.

Patch guidance

Progress has released patches addressing this vulnerability. Consult the official Progress MOVEit Transfer security advisory for exact patch version numbers and installation instructions for your deployment model (cloud vs. on-premises). Test patches in a non-production environment first, as file upload logic changes may affect custom workflows. Schedule patching during a maintenance window and verify file integrity of critical transfer repositories after deployment. Document your patch application date for compliance reporting.

Detection guidance

Monitor MOVEit Transfer audit logs for suspicious file upload patterns, particularly uploads that reference unusual path syntax (e.g., double slashes, dot-dot sequences, or URL-encoded characters). Track user accounts performing uploads outside normal business hours or with unusual frequency. Network detection should flag unusual file modifications in MOVEit directories. If endpoint detection and response (EDR) tools are deployed on MOVEit servers, watch for process activity related to file writing in unexpected locations. Baseline normal upload behavior and alert on deviations.

Why prioritize this

Despite its LOW CVSS score, this vulnerability merits timely attention because: (1) it affects file integrity in a file transfer solution where integrity is the core security promise, (2) patching is straightforward and low-risk, (3) affected versions are recent and may be in active deployment, and (4) the attack surface, while bounded by authentication requirements, expands significantly if user accounts are compromised. Treat as medium priority for patch deployment, not emergency, but do not defer indefinitely.

Risk score, explained

The CVSS 3.1 score of 3.5 (LOW) reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for Low privilege and user interaction (PR:L/UI:R), unchanged scope (S:U), and impact limited to Integrity only with no confidentiality or availability loss (C:N/I:L/A:N). The score appropriately penalizes the flaw for needing authentication, but the integrity impact in a file transfer tool may warrant organizational risk elevation if compliance or data assurance is critical to your mission.

Frequently asked questions