CVE-2026-90866 PUBLISHED

Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

Assigner: ProgressSoftware
Reserved: 14.09.2026 Published: 29.10.2026 Updated: 29.10.2026

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.1

Product Status

Vendor Progress Software
Product WS_FTP Server
Versions Default: unaffected
  • affected from 0 to 2024.0.7 (excl.)
  • affected from 0 to 2025.0.4 (excl.)

Workarounds

Limit delegation of Host Administrator privileges to trusted staff, and periodically audit virtual folder physical paths to confirm they remain within their assigned host root. Contact Progress Software Technical Support for guidance on available mitigations.

Credits

  • Niv Levy (restricted) finder

References

Problem Types

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE
  • CWE-434: Unrestricted Upload of File with Dangerous Type CWE

Impacts

  • Path Traversal - may allow a delegated administrator to escape their assigned host root and achieve remote code execution