CVE-2026-90868EUVD-2026-113025
OS Command Injection in Progress WS_FTP Server
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2024.0.7, 2025.0.4
- Public exploit
- None on Exploit-DB, Metasploit or GitHub
Summary
The vulnerability affects Progress Software's WS_FTP Server on Windows, a file transfer product. Under certain configurations, it could allow an attacker to run arbitrary commands on the affected system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Progress Software WS_FTP Server
fixed in 2024.0.7; fixed in 2025.0.4