CVE-2026-90864EUVD-2026-113021
Host Administrator Path Containment Bypass in Progress WS_FTP Server
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2024.0.7, 2025.0.4
- Public exploit
- None on Exploit-DB, Metasploit or GitHub
Summary
Progress WS_FTP Server on Windows is affected. A delegated Host Administrator could use a path traversal flaw to read or change files outside the folders they are authorized to manage.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
Affected versions
- Progress Software WS_FTP Server
fixed in 2024.0.7; fixed in 2025.0.4