CVE-2026-115336 PUBLISHED

FTP Quota Accounting Bypass in Progress WS_FTP Server

Assigner: ProgressSoftware
Reserved: 22.10.2026 Published: 09.11.2026 Updated: 09.11.2026

Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with upload and delete permissions to exceed storage quotas, potentially causing denial of service.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Product Status

Vendor Progress Software
Product WS_FTP Server
Versions Default: unaffected
  • affected from 2025.0.0 to 2025.0.5 (excl.)

Workarounds

There are no workarounds that address this vulnerability.

References

Problem Types

  • CWE-682: Incorrect Calculation CWE

Impacts

  • Excessive Allocation - repeated quota bypass can exhaust shared storage