CVE-2026-90871 PUBLISHED

Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server

Assigner: ProgressSoftware
Reserved: 14.09.2026 Published: 29.10.2026 Updated: 29.10.2026

Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 5.3

Product Status

Vendor Progress Software
Product WS_FTP Server
Versions Default: unaffected
  • affected from 0 to 2024.0.7 (excl.)
  • affected from 0 to 2025.0.4 (excl.)

Workarounds

By default the affected anonymous account can only delete files it previously created; ensure it is not granted broader write/delete permissions than required on Ad Hoc Transfer and Web Transfer related directories. Contact Progress Software Technical Support for guidance on available mitigations.

Credits

  • Momen Elmady (0xmatrix) finder

References

Problem Types

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE
  • CWE-73: External Control of File Name or Path CWE

Impacts

  • Path Traversal - could allow file deletion outside intended directory boundaries, subject to the affected account’s permissions.