Progress WS_FTP Server: Path traversal by delegated Host Administrator
Summary
A path traversal vulnerability (CWE-22) in Progress WS_FTP Server on Windows allows a delegated Host Administrator to access or modify files outside their authorized scope. The attacker needs an existing Host Administrator delegation, which the CVSS vector rates as high privileges required (PR:H). Successful exploitation can affect the confidentiality, integrity and availability of files on the server.
Affected
- WS_FTP Server versions prior to 2024.0.7 (2024 branch)
- WS_FTP Server versions prior to 2025.0.4 (2025 branch)
- Windows installations only
Fixed in
- WS_FTP Server 2024.0.7
- WS_FTP Server 2025.0.4
Workaround
- Limit delegated administrative privileges to trusted personnel.
- Review folder configurations and account permissions so access stays within authorized boundaries.
- Contact Progress Software Technical Support for guidance on available mitigations.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No known exploitation in the sources reviewed.
- No public proof of concept found in the sources reviewed.
Our recommendation
- Inventory all WS_FTP Server instances, including Windows hosts and exposed admin interfaces.
- Upgrade to 2024.0.7 or 2025.0.4 as a priority, since Progress fixed several related issues in the same batch.
- Review all Host Administrator accounts and delegations and remove those that are not needed.
- Check the vendor advisory for further mitigations and indicators of compromise, and monitor for unusual file access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Progress advisory (Knowledge base) progress.lightning.force.com
- PSIRT CVE record CVE-2026-90864 psirt.com
- Strix CVE summary CVE-2026-90864 www.strix.ai
- VulDB entry 428663 vuldb.com
- WS_FTP Server 2024 release notes docs.progress.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:11.
Original description (NVD)
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.