CVE-2026-90872: Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server
Published Oct 29, 2026
·Updated
Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WSFTP Server IIS worker process.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2024.0.7 - Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.4
Event History
Oct 29, 2026
CVE Published
via MITRE·03:57 PM
Data Sourced
via MITRE·03:57 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:20 PM
DescriptionSeverityWeakness