CVE-2026-90866: Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

Published Oct 29, 2026

Updated

A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

Event History

Oct 29, 2026

CVE Published

via MITRE·03:52 PM

Data Sourced

via MITRE·03:52 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires a delegated Host Administrator role in WS_FTP Server. The issue affects deployments on Windows.

Which versions need to be remediated?

WS_FTP Server versions earlier than 2024.0.7 and 2025.0.4 are affected.

What is the potential impact of successful exploitation?

A delegated Host Administrator may access filesystem locations outside their authorized virtual-folder scope. This could potentially lead to remote code execution.

CVE-2026-90866: Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

Event History

Frequently Asked Questions

Who can exploit this issue?

Which versions need to be remediated?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which versions need to be remediated?

What is the potential impact of successful exploitation?