---
id: CVE-2026-90864
title: Host Administrator Path Containment Bypass in Progress WS_FTP Server
summary: >-
  A path traversal vulnerability in Progress Software WS_FTP Server versions
  prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host
  Administrator to access or modify files outside their authorized scope.
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
  - CWE-434
vendor: Progress Software
product: WS_FTP Server
affected:
  - ws_ftp_server < 2024.0.7
  - ws_ftp_server < 2025.0.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T03:56:39.496575Z'
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:18:24.999Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-90864'
references:
  - url: >-
      https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view
tags:
  - cve.org
epss: 0.00479
epssPercentile: 0.41462
ingestedAt: '2026-11-05T16:24:31.174Z'
---

## Overview

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.

## Affected

- `ws_ftp_server < 2024.0.7`
- `ws_ftp_server < 2025.0.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Limit delegated administrative privileges to trusted personnel. Review folder configurations and account permissions to ensure access remains within authorized boundaries. Contact Progress Software Technical Support for guidance on available mitigations.