CVE-2026-115341 · Vendor
NO FIX YET · SEE WHAT TO DO
WS_FTP Server's Thin Client Web Transfer component on Windows lets a logged-in FTP user access files outside the folders they are meant to see. An attacker who already has a valid FTP account can read files they should not be able to reach.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
WS_FTP Server on Windows before 2025.0.5 that uses the Thin Client Web Transfer component. The attacker needs an authenticated FTP account, so servers with only anonymous or no user access are less exposed. Systems that do not run this component are not affected.
Not affected if auth-required, no-thin-client-web-transfer, non-windows
Who cares file-transfer, windows, ws_ftp-server
2025.0.5 or later.Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.