This vulnerability involves improper neutralization of special elements in output used by a downstream component, specifically allowing HTML injection in system-generated emails within Fortra GoAnywhere MFT versions before 7.10.0. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, required privileges of low, user interaction required, and impacts on confidentiality and integrity with no impact on availability. The vendor has published the vulnerability but has not yet provided an official fix or remediation level. The vulnerability could allow an attacker to inject HTML content into emails generated by the system, potentially affecting the confidentiality and integrity of information processed or displayed.

The vulnerability could allow an attacker to inject malicious HTML content into system-generated emails, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact. The attack requires network access, low complexity, low privileges, and user interaction. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented by Fortra, users should monitor vendor communications for updates. Until a fix is available, cautious handling of system-generated emails and limiting exposure to untrusted users may reduce risk.