CVE-2026-90871
MediumCVSS 5.3Summary
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to improper limitation of a pathname to a restricted directory. An unauthenticated attacker could exploit this to affect files outside the intended directory.
Risk Assessment
An unauthenticated attacker could access files outside the intended directory, potentially leading to unauthorized data access or modification. This may compromise data confidentiality and integrity.
Recommendation
Update Progress Software WS_FTP Server to version 2024.0.7 or 2025.0.4 (or later). Verify file system access permissions.
Other vulnerabilities in Progress Software WS_FTP Server
See all- CVE-2026-90872Medium
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to improper neutralization of directives in dynamically evaluated code in the Manager web console. An authenticated Manager administrator could exploit this to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
- CVE-2026-90870Medium
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to a missing release of backend receiver sessions in the Ad Hoc Transfer component. This could lead to server resource exhaustion and service degradation.
- CVE-2026-90868Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution under certain configurations.
- CVE-2026-90866Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
- CVE-2026-90865Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution with elevated privileges under certain configurations.
- CVE-2026-90864Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access or modify files outside their authorized scope.
- CVE-2026-90863Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows have missing authorization in the administrative interface that could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
- CVE-2026-84295Critical
Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows contain an improper authentication flaw that could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Original NVD description (English source)
Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS