CVE-2026-115336 · Vendor
NO FIX YET · SEE WHAT TO DO
WS_FTP Server releases before 2025.0.5 on Windows miscount storage quotas. An authenticated user with upload and delete permissions can push past their quota, which can cause a denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Windows installations of WS_FTP Server before 2025.0.5 where users hold both upload and delete permissions. The attacker must already have a valid account, so teams with no shared or external FTP users face lower risk.
Not affected if auth-required, no-upload-delete-users, non-windows-hosts
Who cares file-transfer, windows, ws_ftp-server
2025.0.5 are in the affected range.2025.0.5 or later.Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with upload and delete permissions to exceed storage quotas, potentially causing denial of service.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.