Skip to content
OpenAdvisories
High WID-SEC-2026-4433 6 CVEs

Progress Software WS_FTP: Mehrere Schwachstellen

Published Nov 9, 2026 · Updated Nov 9, 2026 · de

Vendor: Progress Software Product: WS_FTP Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Progress Software WS_FTP ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren, Informationen auszulesen oder einen Denial-of-Service-Zustand herbeizuführen.

Product

WS_FTP ist eine FTP (File Transfer Protocol) Software, die zur Übertragung von Dateien zwischen einem Client und einem Server über das Internet verwendet wird.

Vulnerabilities 6

  • High 8.1
    CVE-2026-115338

    Insecure XFT Transport in Progress WS_FTP Server

    Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.

    Progress Software WS_FTP Server
  • High 7.7
    CVE-2026-115341

    Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server

    Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.

    Progress Software WS_FTP Server
  • High 7.5
    CVE-2026-115339

    Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Server

    Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service.

    Progress Software WS_FTP Server
  • High 7.1
    CVE-2026-115340

    Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server

    Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.

    Progress Software WS_FTP Server
  • Medium 6.5
    CVE-2026-115336

    FTP Quota Accounting Bypass in Progress WS_FTP Server

    Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with upload and delete permissions to exceed storage quotas, potentially causing denial of service.

    Progress Software WS_FTP Server
  • Medium 6.3
    CVE-2026-115337

    Folder Permission Bypass in Progress WS_FTP Server

    Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users.

    Progress Software WS_FTP Server

Revision history

  1. #1

    Initiale Fassung

References