This vulnerability (CWE-943) in Progress MOVEit Transfer relates to improper neutralization of special elements in data query logic within the Custom Reports modules. Affected versions include those before 2025.0.7 and versions starting at 2025.1.0 but before 2025.1.3. The issue could allow an attacker with high privileges and user interaction to impact confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, and user interaction needed. No vendor advisory or patch information is currently available.

Successful exploitation could lead to high impact on confidentiality, integrity, and availability of the affected system. However, exploitation requires high privileges and user interaction, and the attack complexity is high. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to the affected MOVEit Transfer versions and monitor for unusual activity. Follow vendor updates closely for any forthcoming patches or mitigations.