Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server on Windows allows bypassing directory restrictions through path traversal.
An unauthenticated attacker over the network can write to or modify files outside the intended restricted directory on the WS_FTP Server.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patches are available in versions 2024.0.7 and 2025.0.4 or later.
Upgrade Progress Software WS_FTP Server to version 2024.0.7 or 2025.0.4 or later. Restrict network access to WS_FTP Server to trusted IP addresses using firewall rules. Monitor file system changes for unauthorized modifications outside expected directories.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Feedly found the first article mentioning CVE-2026-90871 . See article
NVD published the first details for CVE-2026-90871
A CVSS base score of 5.3 has been assigned.
Links to Mitre Att&cks
[GHSA-8298-7w39-fvv4] Improper limitation of a pathname to a restricted directory in Progress Software
[critical] Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4
Progress WS_FTP Server CVE-2026-84295 and CVE-2026-90868: Critical Flaws Fixed in 2024.0.7 and 2025.0.4
CVE-2026-90871 | Progress WS_FTP Server up to 2024.0.6/2025.0.3 path traversal
CVE-2026-90871 - Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
