CVE-2026-90866 in WS_FTP Server
Summary
by MITRE • 10/29/2026
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The identified security flaw resides within the Progress Software WS_FTP Server application, specifically affecting versions released prior to 2024.0.7 and 2025.0.4 when deployed on Microsoft Windows operating systems. This vulnerability is classified as a path traversal issue, which fundamentally stems from insufficient validation of user-supplied input regarding file system paths. In the context of enterprise File Transfer Protocol servers like WS_FTP Server, strict access controls are essential to ensure that users can only interact with files and directories within their designated home or authorized directories. The flaw allows an attacker who holds a delegated Host Administrator role to manipulate path parameters in such a way that they can traverse up the directory tree using standard sequence characters, thereby escaping the restricted environment intended for their account level.
From a technical perspective, this vulnerability exploits weaknesses in how the application processes relative and absolute paths during file operations or administrative tasks. When an authenticated user with elevated privileges but limited scope attempts to access resources, the server fails to properly canonicalize or sanitize the requested path before executing system calls. This oversight permits the injection of directory traversal sequences that bypass the chroot-like restrictions typically enforced for delegated administrators. By navigating outside their authorized sandbox, the attacker gains read and potentially write access to sensitive configuration files, credential stores, or other critical system components located in higher-level directories on the Windows file system hierarchy.
The operational impact of this vulnerability is severe due to its potential escalation path from privilege abuse to remote code execution. While the initial flaw grants unauthorized directory traversal, the consequences extend far beyond simple data exfiltration. An attacker who can write to specific locations within the server's installation directory or configuration paths may be able to inject malicious scripts, modify executable binaries, or alter service configurations that are executed with higher privileges by the system account running the WS_FTP Server process. This capability effectively allows a lower-privileged delegated administrator to achieve arbitrary code execution on the underlying host machine, compromising the integrity and availability of the entire server infrastructure.
This incident aligns closely with Common Weakness Enumeration identifier CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal attacks. Furthermore, in terms of tactical mapping within the MITRE ATT&CK framework, this vulnerability facilitates techniques related to Privilege Escalation and Defense Evasion by allowing an actor to bypass intended access controls and move laterally through the file system beyond their permitted boundaries. The exploitation chain typically involves initial authentication as a delegated administrator followed by crafted requests that exploit the path handling logic to reach restricted areas of the operating system.
To mitigate this risk, organizations running Progress Software WS_FTP Server must immediately apply the vendor-provided patches included in version 2024.0.7 or later for the legacy branch and version 2025.0.4 or later for the current release line. It is critical to verify that all instances of the software across the enterprise environment are updated, as unpatched systems remain vulnerable to exploitation by any authenticated user possessing delegated Host Administrator privileges. In addition to patching, administrators should review and enforce strict least-privilege principles, ensuring that delegated accounts have only the minimum necessary permissions required for their operational duties. Regular auditing of access logs can also help detect attempts at path traversal or unauthorized directory access before they lead to more severe compromise scenarios involving remote code execution.