CVE-2026-115341 PUBLISHED

Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server

Assigner: ProgressSoftware
Reserved: 22.10.2026 Published: 09.11.2026 Updated: 09.11.2026

Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 7.7

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Progress Software
Product	WS_FTP Server
Versions	Default: unaffected affected from 0 to 2025.0.5 (excl.)

Workarounds

Restrict network access to the Thin Client Web Transfer HTTPS endpoint to trusted hosts, or disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.

Credits

Mateusz Mieczkowski (rexnets) finder

References

https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026

Problem Types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE
CWE-862: Missing Authorization CWE

Impacts

Path Traversal