CVE-2026-115340 · Other
NO FIX YET · SEE WHAT TO DO
Before version 2025.0.5, WS_FTP Server on Windows may write sensitive user credential and session data to a temporary file during file transfers. A local user who can read that temporary file could obtain those credentials and sessions.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running WS_FTP Server on Windows with a version before 2025.0.5 are affected. The flaw is in file transfer handling, so systems that do not run WS_FTP Server can skip it. Whether an attacker needs local access to the host is not stated in the sources.
Not affected if non-windows-hosts, version-2025.0.5-or-later
Who cares file-transfer, windows, ws_ftp-server
2025.0.5 or later, per the NVD entry.Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.