Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-90864 EUVD-2026-113021GHSA-pp85-j4v2-w38m

Host Administrator Path Containment Bypass in Progress WS_FTP Server

Published Oct 29, 2026 · Updated Oct 30, 2026 · Assigned by ProgressSoftware

Vendor: Progress Software Product: WS_FTP Server

Description

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.

Affected products

VendorProductAffectedFixed
Progress Software WS_FTP Server < 2024.0.7, < 2025.0.4 2024.0.7

Advisories 1

References