{"id":"CVE-2026-115337","kind":"vulnerability","aliases":["CVE-2026-115337"],"related":[],"title":"WS_FTP Server: folder permission flaw lets users reach other users' files","description":"Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users.","summary":"Progress WS_FTP Server versions before 2025.0.5 fail to enforce access restrictions for users with certain folder-management permissions. An authenticated user can read or change files that belong to other users.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","self-hosted","vendor","ws_ftp-server"],"not_affected_if":["no-folder-management-permissions","version-2025.0.5-or-later"],"how_to_check":"- Check the installed WS_FTP Server version in the admin console or on the server.\n- Review which accounts hold folder-management permissions.","fix":"- Move to WS_FTP Server `2025.0.5` or later.","status":"open","published_at":"2026-11-09T17:17:11+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","triaged_at":"2026-11-09T17:28:56+00:00","updated_at":"2026-11-09T17:28:56+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-09T17:28:56Z","model":"claude-haiku-5-5","output":{"fix":"- Move to WS_FTP Server `2025.0.5` or later.","reach":"network","title":"WS_FTP Server: folder permission flaw lets users reach other users' files","impact":"medium","summary":"Progress WS_FTP Server versions before 2025.0.5 fail to enforce access restrictions for users with certain folder-management permissions. An authenticated user can read or change files that belong to other users.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ws_ftp-server","self-hosted","file-transfer"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads or modifies other users' files","analyst_note":"unknown","how_to_check":"- Check the installed WS_FTP Server version in the admin console or on the server.\n- Review which accounts hold folder-management permissions.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2025.0.5-or-later","no-folder-management-permissions"],"who_is_affected":"Organizations that run WS_FTP Server earlier than 2025.0.5 and give some users folder-management permissions. Exposure needs a valid login, so servers where all users are trusted are at lower risk. Servers already on 2025.0.5 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4528,"output_tokens":488,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115337':15A,18A '-2026':14A,17A '2025.0.5':36B,74C 'access':40B,64C,88C,91C 'allow':76C 'authent':51B,78C 'belong':59B,95C 'bypass':87C 'certain':45B,81C 'chang':56B 'control':65C 'could':75C 'cve':13A,16A 'enforc':39B 'fail':37B 'file':12A,20B,57B,94C 'file-transf':19B 'flaw':6A 'folder':4A,47B,83C 'folder-manag':46B,82C 'ftp':2A,28B,32B,69C 'ftp-server':27B 'host':24B 'improp':63C 'let':7A 'manag':48B,84C 'modifi':93C 'permiss':5A,49B,85C 'prior':72C 'progress':30B,67C 'reach':9A 'read':54B 'restrict':41B,89C 'self':23B 'self-host':22B 'server':3A,29B,33B,70C 'transfer':21B 'user':8A,11A,43B,52B,62B,79C,98C 'vendor':25B 'version':34B,71C 'ws':1A,26B,31B,68C","nicknames":[],"mitigations":[],"who_affected":"Organizations that run WS_FTP Server earlier than 2025.0.5 and give some users folder-management permissions. Exposure needs a valid login, so servers where all users are trusted are at lower risk. Servers already on 2025.0.5 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["filetransfer","medium","selfhosted","vendor","wsftpserver"],"campaign_type":null,"search_a":"'-115337':15A,18A '-2026':14A,17A 'cve':13A,16A 'file':12A 'flaw':6A 'folder':4A 'ftp':2A 'let':7A 'permiss':5A 'reach':9A 'server':3A 'user':8A,11A 'ws':1A","search_b":"'2025.0.5':36B 'access':40B 'authent':51B 'belong':59B 'certain':45B 'chang':56B 'enforc':39B 'fail':37B 'file':20B,57B 'file-transf':19B 'folder':47B 'folder-manag':46B 'ftp':28B,32B 'ftp-server':27B 'host':24B 'manag':48B 'permiss':49B 'progress':30B 'read':54B 'restrict':41B 'self':23B 'self-host':22B 'server':29B,33B 'transfer':21B 'user':43B,52B,62B 'vendor':25B 'version':34B 'ws':26B,31B","search_c":"'2025.0.5':74C 'access':64C,88C,91C 'allow':76C 'authent':78C 'belong':95C 'bypass':87C 'certain':81C 'control':65C 'could':75C 'file':94C 'folder':83C 'folder-manag':82C 'ftp':69C 'improp':63C 'manag':84C 'modifi':93C 'permiss':85C 'prior':72C 'progress':67C 'restrict':89C 'server':70C 'user':79C,98C 'version':71C 'ws':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115337","severity":null,"published_at":"2026-11-09T17:17:11+00:00","modified_at":"2026-11-09T17:17:11+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","fetched_at":"2026-11-09T17:27:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}