CVE-2026-90871 CVE Vulnerability Disclosures / 5h Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.
Problem Types: CWE-22 | CWE-73 | CWE-22 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CWE-73 CWE-73: External Control of File Name or Path
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Vendor Declared Affected Products
Vendor And Credit
CNA: Momen Elmady (0xmatrix) (en)
Additional Advisory Data
CNA: By default the affected anonymous account can only delete files it previously created; ensure it is not granted broader write/delete permissions than required on Ad Hoc Transfer and Web Transfer related directories. Progress Software Technical Support for guidance on available mitigations.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
