{"id":"CVE-2026-90866","title":"Virtual Folder Path Confinement Bypass in Progress WS_FTP Server","summary":"A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remo…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-22","CWE-434"],"vendor":"Progress Software","product":"WS_FTP Server","affected":["ws_ftp_server < 2024.0.7","ws_ftp_server < 2025.0.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T03:56:41.141423Z"},"published":"2026-10-29","updated":"2026-10-30","sourceUpdated":"2026-10-30T17:18:24.557Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90866","references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"}],"tags":["cve.org"],"epss":0.0073,"epssPercentile":0.54379,"ingestedAt":"2026-11-05T16:24:31.172Z","slug":"CVE-2026-90866","body":"## Overview\n\nA path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.\n\n## Affected\n\n- `ws_ftp_server < 2024.0.7`\n- `ws_ftp_server < 2025.0.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nLimit delegation of Host Administrator privileges to trusted staff, and periodically audit virtual folder physical paths to confirm they remain within their assigned host root. Contact Progress Software Technical Support for guidance on available mitigations.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}