FlagThis
← Back to CVE List
Vulnerability Intelligence Report
Host Administrator Path Containment Bypass in Progress WS_FTP Server

CVE-2026-90864

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.

Path Traversal No Active Exploit Signals
CVSS Base Score
9.1
CRITICAL
Exploitability:2.3
Impact Score:6.1
EPSS Probability:0.48%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—

Weaknesses (CWE)

CWE-22 ↗CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434 ↗CWE-434: Unrestricted Upload of File with Dangerous Type

Affected Products & Versions

Vendor Product Affected Versions
Progress Software WS_FTP Server 0 < 2024.0.7 (affected), 0 < 2025.0.4 (affected)

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗
No reference links found.

Threat Intelligence Signals

EPSS Score
0.479%
GitHub Advisory
GHSA-pp85-j4v2-w38m ↗
Vulnerability Class
Path Traversal

Identity & Timeline

StatusPUBLISHED
Assigning AuthorityProgress Software Corporation · Vendor · USA
Reserved2026-09-14T06:09:55
Published2026-10-29T15:50:29
Last Updated2026-10-30T17:18:24

Related Intelligence

Related CVEs
CVE-2026-84295 CVSS 10.0 — Improper authentication in Progress Software WS_FTP Server versions pr…
CVE-2023-40044 CVSS 10.0 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticate…
CVE-2026-90868 CVSS 9.9 — An OS command injection vulnerability in Progress Software WS_FTP Serv…
CVE-2023-42657 CVSS 9.9 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory tra…
CVE-2026-90866 CVSS 9.1 — A path traversal vulnerability in Progress Software WS_FTP Server vers…
LINK COPIED TO CLIPBOARD