CVE-2026-90871: Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server
Improper limitation of a pathname to a restricted directory in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2024.0.7 - Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.4
Event History
Frequently Asked Questions
Which deployments are affected?
Progress WS_FTP Server installations on Windows are affected if they run a version earlier than 2024.0.7 or 2025.0.4. The issue is described in the Ad Hoc Transfer and Web Transfer functionality.
Does exploitation require authentication or user interaction?
No. The reported vector is network-accessible, with no privileges or user interaction required.
What is the likely impact of successful exploitation?
An attacker could affect files outside the intended directory through path traversal. The vulnerability is identified as leading to file deletion; the supplied metrics indicate integrity impact and no reported confidentiality or availability impact.