CVE-2026-115337 · Vendor
NO FIX YET · SEE WHAT TO DO
Progress WS_FTP Server versions before 2025.0.5 fail to enforce access restrictions for users with certain folder-management permissions. An authenticated user can read or change files that belong to other users.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations that run WS_FTP Server earlier than 2025.0.5 and give some users folder-management permissions. Exposure needs a valid login, so servers where all users are trusted are at lower risk. Servers already on 2025.0.5 or later are not affected.
Not affected if no-folder-management-permissions, version-2025.0.5-or-later
Who cares file-transfer, self-hosted, ws_ftp-server
2025.0.5 or later.Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.