HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to version 7.10.0. The vulnerability allows an attacker to embed arbitrary HTML content, potentially leading to phishing or malicious content being delivered via legitimate email notifications. This weakness is classified under CWE-74, which involves injection flaws that can alter the intended rendering of content.

All installations of Fortra GoAnywhere MFT older than version 7.10.0 are affected. The vulnerability exists in the email generation module and therefore any system that uses the default templating for notifications is at risk.

With a CVSS score of 5.4, the vulnerability is considered moderate severity. The EPSS score is < 1%, indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network access to the system, where an attacker can trigger system-generated emails with malicious HTML content. No special privileges or prior access are required to exploit the vulnerability via the email generation process, making it straightforward for an attacker with network connectivity to the host.