CVE-2026-84294 PUBLISHED

Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server

Assigner: ProgressSoftware
Reserved: 01.09.2026 Published: 29.10.2026 Updated: 29.10.2026

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 7.7

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Progress Software
Product	WS_FTP Server
Versions	Default: unaffected affected from 0 to 2024.0.6 (excl.) affected from 0 to 2025.0.3 (excl.)

Workarounds

Restrict Ad Hoc Transfer functionality to trusted users, or disable it if not required. Apply least-privilege permissions to relevant service accounts.

Credits

Niv Levy (restricted) finder

References

https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view

Problem Types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE

Impacts

Path Traversal - may allow access to files outside intended directories