CVE-2026-115336: FTP Quota Accounting Bypass in Progress WS_FTP Server
Incorrect quota accounting in Progress Software WSFTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with upload and delete permissions to exceed storage quotas, potentially causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must have both upload and delete permissions in WS_FTP Server. The issue affects Windows deployments running releases prior to 2025.0.5.
What is the practical impact?
A qualifying user can exceed configured storage quotas because quota usage is accounted for incorrectly. This can consume storage and potentially cause a denial of service; no confidentiality or integrity impact is specified.
Are all WS_FTP Server installations affected by default?
The available information does not establish whether the required upload and delete permissions are granted by default. Exposure depends on having affected Windows releases and users with both permissions.