File restriction bypass via trailing-space path equivalence

Path equivalence in Progress MOVEit Transfer before 2025.0.8 or 2025.1.0 through 2025.1.3 allows remote authenticated users to bypass extension rules. The File Upload module checks extension masks without canonicalizing a filename that ends in a space, so Windows resolves the accepted name as an equivalent path. Exploitation requires an authenticated uploader, a destination with extension restrictions, and another user to interact with the uploaded file; the bounded impact is acceptance of a prohibited file type.