The vulnerability is a relative path traversal flaw in the Admin Settings module that empowers authenticated administrators to construct requests that reference arbitrary files on the underlying host. By supplying non‑canonical file paths, an attacker can read any file readable by the MOVEit service, exposing sensitive configuration or credential material. The weakness is classified as CWE‑23, a path traversal defect that typically facilitates information disclosure.

Progress MOVEit Transfer is affected. All releases before version 2025.0.7, and releases from 2025.1.0 up to, but not including, 2025.1.3, contain the flaw. Later versions are presumed fixed.

The likely attack vector is an authenticated request sent to the admin interface, requiring administrative privileges. With a CVSS score of 4.5, the issue is considered medium severity, and an EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, and exploitation results in confidentiality compromise of system files without causing denial of service or code execution.