Live › vulnerability › CVE-2026-84294
Progress WS_FTP Server's Ad Hoc Transfer component does not properly limit pathnames on Windows, so an authenticated user can reach files outside their intended directories. The sources rate it CVSS 7.7 (high).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Any Windows server running WS_FTP Server before 2024.0.6 or 2025.0.3 is exposed, and the attacker must already hold a valid user account. The sources do not say whether Ad Hoc Transfer must be enabled to be vulnerable, so treat it as in scope when the feature is present. Servers running other versions or non-Windows hosts are not covered by this description.
No product ranges from the sources yet.
2024.0.6 or later on the 2024.0 line, or 2025.0.3 or later on the 2025.0 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
This page as .md · .json · in your agent: get_signal("CVE-2026-84294")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.