CVE-2026-84294High· 7.7▾ TwilightImproper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
ws_ftp_server < 2024.0.6ws_ftp_server < 2025.0.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Restrict Ad Hoc Transfer functionality to trusted users, or disable it if not required. Apply least-privilege permissions to relevant service accounts.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118038High· 7.1Path Traversal in Telerik Document Processing Libraries AI Agent Tools
CVE-2026-118039High· 7.5XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing
CVE-2026-118040High· 7.5Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing
CVE-2026-118036High· 7.5Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering
CVE-2026-118037High· 7.5Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing
CVE-2026-118035High· 7.5Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing