CVE-2026-90865EUVD-2026-113022
Command Injection via FTP Notification Variables in Progress WS_FTP Server
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2024.0.7, 2025.0.4
- Public exploit
- None on Exploit-DB, Metasploit or GitHub
Summary
Progress Software's WS_FTP Server, a file transfer product for Windows, is affected by this vulnerability. An attacker who can abuse its FTP notification settings could run arbitrary operating system commands with elevated privileges on servers using certain configurations.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Progress Software WS_FTP Server
fixed in 2024.0.7; fixed in 2025.0.4