{"id":"CVE-2026-115341","kind":"vulnerability","aliases":["CVE-2026-115341"],"related":[],"title":"WS_FTP Server: authenticated users can reach files outside their scope","description":"Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.","summary":"WS_FTP Server's Thin Client Web Transfer component on Windows lets a logged-in FTP user access files outside the folders they are meant to see. An attacker who already has a valid FTP account can read files they should not be able to reach.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","vendor","windows","ws_ftp-server"],"not_affected_if":["auth-required","no-thin-client-web-transfer","non-windows"],"how_to_check":"- Check the installed WS_FTP Server version in the admin console or on the server.\n- Confirm whether the Thin Client Web Transfer component is in use.\n- Source does not say how to confirm the exact exposure beyond the version check.","fix":"- Move WS_FTP Server to `2025.0.5` or later.","status":"open","published_at":"2026-11-09T17:17:11+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","triaged_at":"2026-11-09T17:28:48+00:00","updated_at":"2026-11-09T17:28:48+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-09T17:28:48Z","model":"claude-haiku-5-5","output":{"fix":"- Move WS_FTP Server to `2025.0.5` or later.","reach":"network","title":"WS_FTP Server: authenticated users can reach files outside their scope","impact":"medium","summary":"WS_FTP Server's Thin Client Web Transfer component on Windows lets a logged-in FTP user access files outside the folders they are meant to see. An attacker who already has a valid FTP account can read files they should not be able to reach.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ws_ftp-server","windows","file-transfer"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads files outside their assigned scope","analyst_note":"","how_to_check":"- Check the installed WS_FTP Server version in the admin console or on the server.\n- Confirm whether the Thin Client Web Transfer component is in use.\n- Source does not say how to confirm the exact exposure beyond the version check.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","no-thin-client-web-transfer","non-windows"],"who_is_affected":"WS_FTP Server on Windows before 2025.0.5 that uses the Thin Client Web Transfer component. The attacker needs an authenticated FTP account, so servers with only anonymous or no user access are less exposed. Systems that do not run this component are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4530,"output_tokens":544,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115341':14A,17A '-2026':13A,16A '2025.0.5':93C 'abl':71B 'access':45B,75C,103C 'account':63B 'allow':97C 'alreadi':58B 'attack':56B 'authent':4A,99C 'client':32B,80C 'compon':35B,83C 'could':96C 'cve':12A,15A 'file':8A,19B,46B,66B,104C 'file-transf':18B 'folder':49B 'ftp':2A,25B,28B,43B,62B,88C,100C 'ftp-server':24B 'improp':74C 'intend':107C 'let':38B 'log':41B 'logged-in':40B 'meant':52B 'outsid':9A,47B,105C 'prior':91C 'progress':85C 'reach':7A,73B 'read':65B 'restrict':76C 'scope':11A,108C 'see':54B 'server':3A,26B,29B,89C 'softwar':86C 'thin':31B,79C 'transfer':20B,34B,82C 'user':5A,44B,101C 'valid':61B 'vendor':21B 'version':90C 'web':33B,81C 'window':22B,37B,95C 'ws':1A,23B,27B,87C","nicknames":[],"mitigations":[],"who_affected":"WS_FTP Server on Windows before 2025.0.5 that uses the Thin Client Web Transfer component. The attacker needs an authenticated FTP account, so servers with only anonymous or no user access are less exposed. Systems that do not run this component are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["filetransfer","high","vendor","windows","wsftpserver"],"campaign_type":null,"search_a":"'-115341':14A,17A '-2026':13A,16A 'authent':4A 'cve':12A,15A 'file':8A 'ftp':2A 'outsid':9A 'reach':7A 'scope':11A 'server':3A 'user':5A 'ws':1A","search_b":"'abl':71B 'access':45B 'account':63B 'alreadi':58B 'attack':56B 'client':32B 'compon':35B 'file':19B,46B,66B 'file-transf':18B 'folder':49B 'ftp':25B,28B,43B,62B 'ftp-server':24B 'let':38B 'log':41B 'logged-in':40B 'meant':52B 'outsid':47B 'reach':73B 'read':65B 'see':54B 'server':26B,29B 'thin':31B 'transfer':20B,34B 'user':44B 'valid':61B 'vendor':21B 'web':33B 'window':22B,37B 'ws':23B,27B","search_c":"'2025.0.5':93C 'access':75C,103C 'allow':97C 'authent':99C 'client':80C 'compon':83C 'could':96C 'file':104C 'ftp':88C,100C 'improp':74C 'intend':107C 'outsid':105C 'prior':91C 'progress':85C 'restrict':76C 'scope':108C 'server':89C 'softwar':86C 'thin':79C 'transfer':82C 'user':101C 'version':90C 'web':81C 'window':95C 'ws':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115341","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115341","severity":null,"published_at":"2026-11-09T17:17:11+00:00","modified_at":"2026-11-09T17:17:11+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","fetched_at":"2026-11-09T17:27:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}