# CVE-2026-8801: Progress MOVEit Transfer path equivalence in File Upload modules

Source: https://junglewise.ai/threats/cve-2026-8801-progress-moveit-transfer-path-equivalence-in-file-upload-modules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-8801 · Severity: low · CVSS 3.5 · Published 2026-07-08

Progress MOVEit Transfer, a managed file transfer solution used by organizations to securely share data, contains a vulnerability in its file upload module. An attacker with basic user permissions could potentially bypass security rules that restrict which types of files are allowed to be uploaded. This could lead to the storage of unauthorized or prohibited file types on the corporate server.

Technologies: [Progress MOVEit Transfer](https://junglewise.ai/threats/technologies/moveit-transfer). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-8801 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8801 being exploited in the wild.

**How severe is CVE-2026-8801?** Low severity, with a CVSS score of 3.5, published 8 July 2026.

**Which products and versions are affected?** Progress MOVEit Transfer before 2025.0.8, 2025.1.0 before 2025.1.4.

**Is there a fix for CVE-2026-8801?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8801 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8801?** Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path equivalence vulnerability (CWE-46) exists in the File Upload modules of Progress MOVEit Transfer. The flaw stems from improper handling of filenames, specifically involving trailing spaces or similar path equivalence techniques, which can be used to bypass configured file extension restrictions. An attacker with low-privileged network access and minimal user interaction could exploit this to upload prohibited file types. The issue is resolved in versions 2025.0.8 and 2025.1.4.

## Affected products

- Progress MOVEit Transfer before 2025.0.8, 2025.1.0 before 2025.1.4

## Timeline

- 2026-07-08: disclosed
- 2026-07-08: advisory

## References

- [https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html](https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html)

## Related threats

- [Progress MOVEit Transfer SFTP authentication algorithm incorrect implementation](https://junglewise.ai/threats/cve-2026-89077-incorrect-implementation-of-authentication-algorithm)
- [Progress MOVEit Transfer SQL injection in Custom Reports](https://junglewise.ai/threats/cve-2026-89076-improper-neutralization-of-special-elements-used-in-an-sql)
- [Progress MOVEit Transfer insecure storage of sensitive information](https://junglewise.ai/threats/cve-2026-89075-insecure-storage-of-sensitive-information-vulnerability-in)
- [Progress MOVEit Transfer unicode encoding handling vulnerability](https://junglewise.ai/threats/cve-2026-89074-improper-handling-of-unicode-encoding-vulnerability-in-progress)
- [Progress MOVEit Transfer insufficient session expiration](https://junglewise.ai/threats/cve-2026-89073-insufficient-session-expiration-vulnerability-in-progress-moveit)