CVE-2019-6500: Axway File Tranfer Direct

High severity, CVSS 7.5. EPSS: 4.1% chance of exploitation in the next 30 days.

In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters, as demonstrated by an initial /h2hdocumentation//%2e%2e/ substring.

Affected products

• Axway File Tranfer Direct: version 2.7.1 only

Published 2019-01-21. Last modified 2026-06-17.