Low · 3.5 CVE-2026-8801 EUVD-2026-42385GHSA-g7h5-mc2v-rvpm

File Extension Restriction Bypass in MOVEit Transfer

Published Jul 8, 2026 · Updated Jul 9, 2026 · Assigned by ProgressSoftware

Description

Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules).

This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.

Vendor	Product	Affected	Fixed
Progress	MOVEit Transfer	2025.1.0 – < 2025.1.4, < 2025.0.8	2025.1.4