---
id: CVE-2026-90866
title: Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
summary: >-
  A path traversal vulnerability in Progress Software WS_FTP Server versions
  prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host
  Administrator to access locations outside their authorized scope, potentially
  enabling remo…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
  - CWE-434
vendor: Progress Software
product: WS_FTP Server
affected:
  - ws_ftp_server < 2024.0.7
  - ws_ftp_server < 2025.0.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T03:56:41.141423Z'
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:18:24.557Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-90866'
references:
  - url: >-
      https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view
tags:
  - cve.org
epss: 0.0073
epssPercentile: 0.54379
ingestedAt: '2026-11-05T16:24:31.172Z'
---

## Overview

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

## Affected

- `ws_ftp_server < 2024.0.7`
- `ws_ftp_server < 2025.0.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Limit delegation of Host Administrator privileges to trusted staff, and periodically audit virtual folder physical paths to confirm they remain within their assigned host root. Contact Progress Software Technical Support for guidance on available mitigations.