CVE-2026-90868 in WS_FTP Server
Summary
by MITRE • 10/29/2026
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The identified security flaw represents a critical Operating System Command Injection vulnerability within the Progress Software WS_FTP Server application, specifically affecting versions released prior to 2024.0.7 and 2025.0.4 on Windows operating systems. This type of vulnerability arises when an application fails to properly validate or sanitize user-supplied input before incorporating it into system-level commands executed by the underlying operating system shell. In the context of WS_FTP Server, which serves as a file transfer solution for organizations requiring secure data exchange, this flaw allows attackers who can interact with specific configuration endpoints or upload mechanisms to inject malicious command strings. The vulnerability is contingent upon certain configurations being active, suggesting that while not universally exploitable in all default setups, it poses a significant risk when the server is configured to process dynamic inputs through system shells without adequate isolation or escaping mechanisms.
From a technical perspective, this flaw aligns with Common Weakness Enumeration identifier CWE-78, which describes improper neutralization of special elements used in an OS command. The root cause typically involves the concatenation of unsanitized user input directly into a string that is subsequently passed to functions such as system(), exec(), or similar shell execution APIs within the Windows environment. When an attacker provides crafted input containing shell metacharacters like semicolons, ampersands, pipes, or backticks, they can break out of the intended command context and append arbitrary commands for execution. This capability effectively bypasses application-level access controls because the injected commands are executed with the privileges assigned to the WS_FTP Server service account on the Windows host.
The operational impact of this vulnerability is severe, as it leads directly to Arbitrary Command Execution under the context of the vulnerable software. An authenticated attacker or an unauthenticated actor, depending on which specific configuration vectors are exposed and accessible, could gain full control over the affected server. This level of compromise allows for the exfiltration of sensitive data stored within the FTP directories, modification or deletion of critical system files, installation of persistent backdoors such as web shells or remote access trojans, and potentially pivoting to other systems on the internal network if the service account possesses elevated privileges. The ability to execute commands at this level undermines the core security principles of confidentiality, integrity, and availability that WS_FTP Server is designed to uphold for enterprise file transfer operations.
In terms of threat modeling and adversary behavior, this vulnerability maps closely to techniques found in the MITRE ATT&CK framework, particularly T1059 Command and Scripting Interpreter and T1086 Web Shell. Attackers leveraging this flaw would likely use PowerShell or batch scripts to establish persistence, escalate privileges if possible, and move laterally across the network. The presence of such a vulnerability indicates a failure in secure coding practices regarding input validation and command construction, which are fundamental requirements for any software handling external inputs that interact with system resources.
To mitigate this risk, organizations running WS_FTP Server must immediately apply the vendor-provided patches included in versions 2024.0.7 or later, as well as version 2025.0.4 and subsequent releases. These updates contain code changes designed to properly sanitize inputs and prevent shell injection attacks. In addition to patching, administrators should review server configurations to ensure that the service account runs with the principle of least privilege, minimizing the potential impact if a compromise occurs. Network segmentation strategies should also be employed to restrict access to WS_FTP Server management interfaces from untrusted networks, thereby reducing the attack surface available for exploitation until patches are fully deployed across all affected instances.