CVE-2026-90866EUVD-2026-113023
Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2024.0.7, 2025.0.4
- Public exploit
- None on Exploit-DB, Metasploit or GitHub
Summary
The vulnerability affects Progress Software's WS_FTP Server on Windows. It allows a delegated Host Administrator to reach files and locations outside their authorized virtual folder scope, which could potentially lead to remote code execution.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
Affected versions
- Progress Software WS_FTP Server
fixed in 2024.0.7; fixed in 2025.0.4