CVE-2026-90864: Host Administrator Path Containment Bypass in Progress WS_FTP Server
A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2024.0.7 - Upgrade
Upgrade
Progress WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.4
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires delegated Host Administrator privileges in Progress WS_FTP Server. It is not described as exploitable by an unauthenticated or low-privileged user.
Which deployments are affected?
The issue affects WS_FTP Server deployments on Windows running versions earlier than 2024.0.7 or 2025.0.4.
What can a successful attacker do?
A delegated Host Administrator could use path traversal to access or modify files outside their authorized scope. The listed impact includes confidentiality, integrity, and availability effects.