FlagThis
← Back to CVE List
Vulnerability Intelligence Report
Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

CVE-2026-90866

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

Path Traversal No Active Exploit Signals
CVSS Base Score
9.1
CRITICAL
Exploitability:2.3
Impact Score:6.1
EPSS Probability:0.73%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—

Weaknesses (CWE)

CWE-22 ↗CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434 ↗CWE-434: Unrestricted Upload of File with Dangerous Type

Affected Products & Versions

Vendor Product Affected Versions
Progress Software WS_FTP Server 0 < 2024.0.7 (affected), 0 < 2025.0.4 (affected)

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗
No reference links found.

Threat Intelligence Signals

EPSS Score
0.730%
GitHub Advisory
GHSA-p4xx-h8r7-vfh5 ↗
Vulnerability Class
Path Traversal

Identity & Timeline

StatusPUBLISHED
Assigning AuthorityProgress Software Corporation · Vendor · USA
Reserved2026-09-14T06:09:55
Published2026-10-29T15:52:24
Last Updated2026-10-30T17:18:24

Related Intelligence

Related CVEs
CVE-2026-84295 CVSS 10.0 — Improper authentication in Progress Software WS_FTP Server versions pr…
CVE-2023-40044 CVSS 10.0 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticate…
CVE-2026-90868 CVSS 9.9 — An OS command injection vulnerability in Progress Software WS_FTP Serv…
CVE-2023-42657 CVSS 9.9 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory tra…
CVE-2026-90864 CVSS 9.1 — A path traversal vulnerability in Progress Software WS_FTP Server vers…
LINK COPIED TO CLIPBOARD