{"id":"CVE-2026-115340","kind":"vulnerability","aliases":["CVE-2026-115340"],"related":[],"title":"WS_FTP Server on Windows writes credentials to temp files","description":"Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.","summary":"Before version 2025.0.5, WS_FTP Server on Windows may write sensitive user credential and session data to a temporary file during file transfers. A local user who can read that temporary file could obtain those credentials and sessions.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","other","windows","ws_ftp-server"],"not_affected_if":["non-windows-hosts","version-2025.0.5-or-later"],"how_to_check":"- Check the installed WS_FTP Server version in the product's About or admin console; unknown if the sources do not give the exact path.\n- Look for temporary files created during transfers on the Windows host; unknown if the sources do not say where they are written.","fix":"- WS_FTP Server: move to `2025.0.5` or later, per the NVD entry.","status":"open","published_at":"2026-11-09T17:17:11+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","triaged_at":"2026-11-09T17:28:54+00:00","updated_at":"2026-11-09T17:28:54+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T17:28:54Z","model":"claude-haiku-5-5","output":{"fix":"- WS_FTP Server: move to `2025.0.5` or later, per the NVD entry.","reach":"local","title":"WS_FTP Server on Windows writes credentials to temp files","impact":"medium","summary":"Before version 2025.0.5, WS_FTP Server on Windows may write sensitive user credential and session data to a temporary file during file transfers. A local user who can read that temporary file could obtain those credentials and sessions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ws_ftp-server","windows","file-transfer"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Credentials and session data readable from temporary files on disk","analyst_note":"Confirm the temporary file location, whether a remote attacker can trigger it, and the exact fixed version at the NVD entry or the Progress advisory.\n\n","how_to_check":"- Check the installed WS_FTP Server version in the product's About or admin console; unknown if the sources do not give the exact path.\n- Look for temporary files created during transfers on the Windows host; unknown if the sources do not say where they are written.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-windows-hosts","version-2025.0.5-or-later"],"who_is_affected":"Teams running WS_FTP Server on Windows with a version before 2025.0.5 are affected. The flaw is in file transfer handling, so systems that do not run WS_FTP Server can skip it. Whether an attacker needs local access to the host is not stated in the sources.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000743,"input_tokens":4512,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115340':13A,16A '-2026':12A,15A '2025.0.5':28B,72C 'could':58B 'credenti':7A,38B,61B,79C 'cve':11A,14A 'data':41B,82C 'file':10A,18B,45B,47B,57B,86C,88C 'file-transf':17B 'ftp':2A,24B,30B,67C 'ftp-server':23B 'local':50B 'may':34B,75C 'obtain':59B 'oper':90C 'prior':70C 'progress':64C 'read':54B 'sensit':36B,77C 'server':3A,25B,31B,68C 'session':40B,63B,81C 'softwar':65C 'temp':9A 'temporari':44B,56B,85C 'transfer':19B,48B,89C 'user':37B,51B,78C 'version':27B,69C 'window':5A,21B,33B,74C 'write':6A,35B,76C 'ws':1A,22B,29B,66C","nicknames":[],"mitigations":[],"who_affected":"Teams running WS_FTP Server on Windows with a version before 2025.0.5 are affected. The flaw is in file transfer handling, so systems that do not run WS_FTP Server can skip it. Whether an attacker needs local access to the host is not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["filetransfer","high","other","windows","wsftpserver"],"campaign_type":null,"search_a":"'-115340':13A,16A '-2026':12A,15A 'credenti':7A 'cve':11A,14A 'file':10A 'ftp':2A 'server':3A 'temp':9A 'window':5A 'write':6A 'ws':1A","search_b":"'2025.0.5':28B 'could':58B 'credenti':38B,61B 'data':41B 'file':18B,45B,47B,57B 'file-transf':17B 'ftp':24B,30B 'ftp-server':23B 'local':50B 'may':34B 'obtain':59B 'read':54B 'sensit':36B 'server':25B,31B 'session':40B,63B 'temporari':44B,56B 'transfer':19B,48B 'user':37B,51B 'version':27B 'window':21B,33B 'write':35B 'ws':22B,29B","search_c":"'2025.0.5':72C 'credenti':79C 'data':82C 'file':86C,88C 'ftp':67C 'may':75C 'oper':90C 'prior':70C 'progress':64C 'sensit':77C 'server':68C 'session':81C 'softwar':65C 'temporari':85C 'transfer':89C 'user':78C 'version':69C 'window':74C 'write':76C 'ws':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115340","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115340","severity":null,"published_at":"2026-11-09T17:17:11+00:00","modified_at":"2026-11-09T17:17:11+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","fetched_at":"2026-11-09T17:27:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}