CVE-2026-90864 PUBLISHED

Host Administrator Path Containment Bypass in Progress WS_FTP Server

Assigner: ProgressSoftware
Reserved: 14.09.2026 Published: 29.10.2026 Updated: 29.10.2026

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.1

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Progress Software
Product	WS_FTP Server
Versions	Default: unaffected affected from 0 to 2024.0.7 (excl.) affected from 0 to 2025.0.4 (excl.)

Workarounds

Limit delegated administrative privileges to trusted personnel. Review folder configurations and account permissions to ensure access remains within authorized boundaries. Contact Progress Software Technical Support for guidance on available mitigations.

References

https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view

Problem Types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE
CWE-434: Unrestricted Upload of File with Dangerous Type CWE

Impacts

Path Traversal - may allow access to or modification of files outside authorized directory boundaries