CVE-2026-8801 is a low severity (CVSS 3.5) path equivalence flaw in the upload modules of Progress MOVEit Transfer. The release notes say it could allow file extension restrictions to be bypassed. Fixed versions are 2025.0.8 and 2025.1.4, so update if you rely on those restrictions.
What's affected
The record lists MOVEit Transfer before 2025.0.8, and from 2025.1.0 before 2025.1.4. Those two fixed releases are the targets for the two release lines.
The Progress release notes list the fix under the uploader, with the description that it could allow file extension restrictions to be bypassed. The record vector needs a signed-in user and some user interaction, with limited impact on integrity only.
How to check if you're exposed
Sign in to the MOVEit Transfer web interface as an administrator and check the version in the About or System information area. Compare it with 2025.0.8 for the 2025.0 line and 2025.1.4 for the 2025.1 line.
Then review whether you rely on extension restrictions as a control, for example to block executable file types on upload. If you do, treat the fix as more urgent.
What to do now
- Update MOVEit Transfer to 2025.0.8 or 2025.1.4, or any later release.
- Back up the database and configuration before the upgrade.
- Do not rely on file extension rules alone. Add content scanning for uploads.
- Review your upload policy for which types are blocked and why.
Why it matters
The record lists CWE-46 (path equivalence, trailing space). Path equivalence bugs happen when two spellings of a name mean the same thing to the file system but different things to a rule engine. A filter that checks for a blocked extension can then miss a name that the system treats as that extension.
The severity is low, but the lesson is useful. Extension filters are a weak control by themselves. Scan content, store uploads outside the web path, and do not run uploaded files.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
Is this the same as the older MOVEit Transfer issues?
No. This record is a separate low severity upload filter issue. Read the release notes for this specific fix.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
