CVE-2026-90871 in WS_FTP Server
Summary
by MITRE • 10/29/2026
Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified as Improper Limitation of a Pathname to a Restricted Directory represents a critical security flaw within Progress Software WS_FTP Server, specifically affecting versions prior to 2024.0.7 and 2025.0.4 on Windows operating systems. This class of defect is formally categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory in the Common Weakness Enumeration database. The core technical issue stems from insufficient validation or sanitization of user-supplied input when processing file path requests. In secure implementations, applications must strictly enforce directory boundaries by ensuring that any requested resource resides within an explicitly defined and restricted root directory. However, in this instance, the server fails to adequately normalize or validate paths containing traversal sequences such as dot-dot-slash (..), which are standard mechanisms for navigating up a file system hierarchy.
When an unauthenticated attacker submits a request with carefully crafted path parameters, they can exploit these validation gaps to escape the intended web root or FTP directory structure. By injecting relative path traversals into filenames or directory names during upload, download, or listing operations, the attacker directs the server to access files located outside the sandboxed environment. This lack of strict boundary enforcement allows the application to resolve paths that point to sensitive system directories, configuration files, or other critical data stored on the underlying Windows file system. The vulnerability does not require prior authentication, significantly lowering the barrier for exploitation and allowing any network-accessible user to attempt this attack vector without credentials.
The operational impact of this vulnerability is severe, as it effectively compromises the confidentiality and integrity of the host system's file structure. An attacker can read sensitive files such as configuration documents containing database passwords or API keys, leading to a full compromise of application security controls. Furthermore, depending on the specific context of how WS_FTP Server handles these paths during write operations, there may be potential for arbitrary file overwrite if the server permits writing through traversed paths. This could allow an attacker to replace legitimate system files with malicious content, potentially facilitating further attacks such as remote code execution or service disruption. The ability to access restricted directories undermines the fundamental security principle of least privilege and isolation that is essential for secure FTP and web-based file transfer services.
Mitigation strategies must prioritize immediate patching and robust input validation practices. Administrators should upgrade Progress Software WS_FTP Server to version 2024.0.7 or later, where this path traversal logic has been corrected to properly restrict access to the designated directory tree. In environments where upgrading is not immediately feasible, network-level controls such as firewall rules can limit exposure by restricting access to only trusted IP addresses. Additionally, implementing strict input validation on all file-related endpoints to reject any paths containing relative navigation sequences is a critical defensive measure. Security teams should also monitor server logs for patterns indicative of path traversal attempts and ensure that the service runs with minimal privileges to reduce the impact if an exploit succeeds. This vulnerability aligns with ATT&CK technique T1083: File and Directory Discovery, as it enables attackers to enumerate and access restricted system resources without authorization.