CVE-2026-115337: Folder Permission Bypass in Progress WS_FTP Server
Improper access control in Progress WSFTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WS_FTP Server and have certain folder-management permissions. The issue is not described as exploitable by unauthenticated users.
What access could an attacker gain?
A qualifying user could bypass intended folder access restrictions to access or modify files that belong to other users.
Which versions are affected?
Progress WS_FTP Server versions prior to 2025.0.5 are affected. Updating to 2025.0.5 or later addresses the affected-version condition described in the advisory.