CVE-2026-8650

Executive Summary

CVE-2026-8650 is a relative path traversal vulnerability (CWE-23) discovered in the Admin Settings module of Progress MOVEit Transfer. This flaw allows an authenticated attacker with administrative privileges to read or write arbitrary files outside the intended directory, potentially leading to unauthorized access to sensitive configuration data or system files. The vulnerability affects versions prior to 2025.0.7 and versions from 2025.1.0 before 2025.1.3. Progress has released patches in versions 2025.0.7 and 2025.1.3. The CVSS score is 4.5 (Medium), and the EPSS probability is 0.0%, indicating low exploitation activity at the time of analysis. No public proof-of-concept (PoC) code or exploit templates are currently available.

Supply Chain & Package Security

MOVEit Transfer is a proprietary enterprise file transfer solution. This vulnerability does not directly affect open-source packages (NPM, PyPI, Go, Ruby). However, organizations using MOVEit Transfer should treat this as a critical supply chain risk due to the product's role in sensitive data transfer. Ensure that the software is updated only from official Progress sources and verify checksums after patching.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 4.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated admin access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for administrative privileges reduces the attack surface, but once authenticated, an attacker can traverse directories to access or modify files outside the Admin Settings module. This could lead to disclosure of configuration secrets or tampering with system files.

Deep Dive & Mechanics

The vulnerability resides in the Admin Settings module of MOVEit Transfer. The module fails to properly sanitize user-supplied input used in file path construction. By injecting ../ sequences, an authenticated admin can escape the intended directory and access arbitrary files on the server filesystem.

Root Cause: The application uses user input to construct file paths without validating or canonicalizing the path. For example, a parameter like file=../../etc/passwd would be processed without checking for path traversal patterns.

Attack Scenario:

1. An attacker gains administrative credentials (via phishing, credential stuffing, or other means).
2. The attacker logs into the MOVEit Transfer admin panel.
3. The attacker crafts a request to the Admin Settings module with a malicious file parameter containing ../ sequences.
4. The server reads or writes the file at the traversed path, allowing the attacker to exfiltrate sensitive data (e.g., /etc/shadow, database configs) or overwrite critical files.

Impact: Unauthorized read access to system files (e.g., configuration files, SSH keys) or write access to files that could lead to privilege escalation or remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: Directly uses user input in file path
def read_admin_file(filename):
    base_path = "/var/www/moveit/admin/"
    full_path = base_path + filename
    with open(full_path, 'r') as f:
        return f.read()

Patched Code (Conceptual):

import os

def read_admin_file(filename):
    base_path = "/var/www/moveit/admin/"
    # Canonicalize and validate path
    full_path = os.path.realpath(os.path.join(base_path, filename))
    if not full_path.startswith(base_path):
        raise ValueError("Invalid file path")
    with open(full_path, 'r') as f:
        return f.read()

The patched version uses os.path.realpath() to resolve any ../ sequences and then checks that the resolved path starts with the expected base directory, preventing traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid admin credentials for MOVEit Transfer.
• Network access to the admin interface (typically on port 443).

Exploitation Steps:

1. Log in to the MOVEit Transfer admin panel.
2. Identify the vulnerable endpoint (e.g., /admin/settings/file?file=).
3. Craft a request to read /etc/passwd:

   GET /admin/settings/file?file=../../../../etc/passwd HTTP/1.1
   Host: target.com
   Cookie: session=valid_admin_session
   

4. The server returns the contents of /etc/passwd.

Example cURL Command:

curl -k -X GET "https://target.com/admin/settings/file?file=../../../../etc/passwd" \
  -H "Cookie: session=valid_admin_session"

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Detection & Defense)

Detection:

• Monitor for HTTP requests to /admin/settings/file with parameters containing ../ or ..%2f.
• Alert on unusual file read/write operations from the MOVEit process (e.g., reading /etc/shadow).
• Use file integrity monitoring (FIM) on critical system files.

Defense:

• Apply the patch immediately (upgrade to 2025.0.7 or 2025.1.3).
• Restrict admin access to trusted IPs and enforce multi-factor authentication (MFA).
• Implement web application firewall (WAF) rules to block path traversal patterns.
• Regularly audit admin account usage.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/settings/file with ../ in the file parameter.
• Outbound connections from the MOVEit server to unknown IPs (data exfiltration).

File System IOCs:

• Unexpected access to files outside the MOVEit installation directory (e.g., /etc/passwd, /etc/shadow).
• Modified configuration files in /var/www/moveit/admin/ or system directories.

Log IOCs:

• Web server logs showing GET /admin/settings/file?file=../../ entries.
• Application logs with errors related to file path validation.

Detection Engineering

YARA Rule

rule CVE_2026_8650_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting MOVEit Transfer Admin Settings"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-8650"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $admin_path = "/admin/settings/file"
    condition:
        any of ($traversal*) and $admin_path
}

Sigma Rule

title: CVE-2026-8650 MOVEit Transfer Path Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in MOVEit Transfer Admin Settings
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin/settings/file'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate file access with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-8650 MOVEit Transfer Path Traversal Attempt"; flow:to_server; content:"GET"; http_method; content:"/admin/settings/file"; http_uri; content:"../"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade MOVEit Transfer to version 2025.0.7 or 2025.1.3 (or later).
2. Workaround: If patching is not immediately possible, restrict access to the Admin Settings module to trusted IPs only and enforce MFA for all admin accounts.
3. Monitor: Review logs for any signs of exploitation (see IOCs).

Long-Term Measures:

• Implement a web application firewall (WAF) with rules to block path traversal patterns.
• Conduct regular security audits and penetration testing on MOVEit Transfer.
• Apply the principle of least privilege to admin accounts.
• Enable detailed logging and alerting for file access anomalies.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.