Path Traversal Vulnerabilities Discovered in Software Products
Article Content
- •CVE-2026-43851 allows authenticated attackers to read arbitrary files with CVSS 8.2.
- •CVE-2026-90871 affects Progress Software's WS_FTP Server, enabling unauthenticated file access.
- •Both vulnerabilities stem from improper path handling, classified under CWE-22.
Two significant path traversal vulnerabilities have been disclosed recently. CVE-2026-43851, reported by Nozomi Networks, allows authenticated attackers to read arbitrary files on systems with a CVSS score of 8.2. This vulnerability requires high-privileged access and is not listed in CISA’s KEV catalog. In contrast, CVE-2026-90871 affects Progress Software's WS_FTP Server, enabling unauthenticated attackers to access files outside the intended directory. This vulnerability is classified under CWE-22 and is present in versions prior to 2024.0.7 and 2025.0.4. Both vulnerabilities highlight the risks associated with improper path handling in software applications.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-43851 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What are the affected versions for CVE-2026-90871?
What is the impact of CVE-2026-43851?
Are there any patches available for these vulnerabilities?
Continue Reading
CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting… 
Critical Path Traversal Vulnerability in FearlessCMS Disclosed A critical vulnerability, CVE-2026-63190, has been identified in FearlessCMS, a flat-file content management system, allowing unauthenticated attackers to execute privileged PHP scripts in the `/admin/` directory. This flaw arises from improper authentication and path validation, enabling attackers to perform path…