CVE-2026-115341: Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server

Published Nov 9, 2026

Updated

Improper access restrictions in the Thin Client Web Transfer component of Progress Software WSFTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Progress Software WS_FTP Server to a version that resolves this vulnerability.
Fixed in 2025.0.5

Event History

Nov 9, 2026

CVE Published

via MITRE·04:45 PM

Data Sourced

via MITRE·04:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be an authenticated FTP user and able to reach the Thin Client Web Transfer component. The issue affects WS_FTP Server installations on Windows running versions earlier than 2025.0.5.

What could an attacker access?

The vulnerability could allow an authenticated FTP user to access files outside the scope they are intended to access. The provided information does not identify specific file locations or permission boundaries that can be bypassed.

What should be done to remediate it?

Upgrade Progress WS_FTP Server to version 2025.0.5 or later. Until upgrading is possible, limit access to authenticated FTP accounts and restrict exposure of the Thin Client Web Transfer component where operationally feasible.

CVE-2026-115341: Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What could an attacker access?

What should be done to remediate it?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could an attacker access?

What should be done to remediate it?