CVE-2026-84294: Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2024.0.6 - Upgrade
Upgrade
Progress WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Windows deployments of Progress Software WS_FTP Server using versions earlier than 2024.0.6 or 2025.0.3 are affected. Exploitation requires an authenticated user account.
What could an attacker access?
An authenticated attacker could use insufficient pathname restrictions in the Ad Hoc Transfer component to access files outside the directories intended for that user or transfer.
Does exploitation require user interaction or advanced conditions?
No user interaction is required, and the listed attack complexity is low. The attacker must first have valid authentication to the affected WS_FTP Server.