Progress WS_FTP Server: Path traversal allows access outside delegated scope
Summary
A path traversal flaw in Progress WS_FTP Server on Windows allows a delegated Host Administrator to reach locations outside their authorized scope. The CNA states this could potentially enable remote code execution. The attacker needs a valid Host Administrator account, so the flaw is not exploitable without prior authentication.
Affected
- Progress Software WS_FTP Server on Windows, versions prior to 2024.0.7 and prior to 2025.0.4
- Unknown whether other platforms are affected (CNA description limits the issue to Windows)
Fixed in
- Upgrade to 2024.0.7 or 2025.0.4 (or later builds of the same branch)
Workaround
- Limit Host Administrator delegation to trusted staff
- Regularly audit the physical paths of virtual folders to confirm they remain within their assigned host root
- Contact Progress Software Technical Support for further mitigations (vendor advisory; interim mitigations not confirmed)
Exploitation
- Not known to be exploited (OffSeq snapshot; Strix lists KEV as No, not confirmed against CISA)
- No public proof of concept found
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Inventory all WS_FTP Server instances and their versions now
- Upgrade any instance below 2024.0.7 or 2025.0.4 with priority
- Review and reduce Host Administrator accounts; enforce strong, unshared credentials and MFA where possible
- Check whether the admin interface is reachable from the internet and restrict access
- Monitor the Progress advisory and NVD/CISA for updates; the sibling CVEs CVE-2026-90868 and CVE-2026-90871 are fixed by the same builds
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Progress Software advisory (CNA record) progress.lightning.force.com
- OffSeq threat radar: CVE-2026-90866 radar.offseq.com
- Strix: CVE-2026-90866 www.strix.ai
- VulDB: CVE-2026-90866 vuldb.com
- OffSeq threat radar: WS_FTP Server path traversal advisory radar.offseq.com
- Rapid7: Critical vulnerabilities in WS_FTP Server (2023) www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:11.
Original description (NVD)
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.