{"id":"CVE-2026-84294","kind":"vulnerability","aliases":["CVE-2026-84294"],"related":[],"title":"WS_FTP Server: Ad Hoc Transfer path flaw exposes files outside intended directories","description":"Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.","summary":"Progress WS_FTP Server's Ad Hoc Transfer component does not properly limit pathnames on Windows, so an authenticated user can reach files outside their intended directories. The sources rate it CVSS 7.7 (high).","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","infrastructure","windows","ws_ftp"],"not_affected_if":["non-windows-host","patched-version"],"how_to_check":"- Check the installed WS_FTP Server version against the fixed releases listed in the fix section.\n- Confirm whether the Ad Hoc Transfer feature is in use on the server.","fix":"- Move WS_FTP Server to `2024.0.6` or later on the 2024.0 line, or `2025.0.3` or later on the 2025.0 line.","status":"open","published_at":"2026-10-29T16:19:29+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","triaged_at":"2026-10-29T16:29:38+00:00","updated_at":"2026-10-29T16:29:38+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-29T16:29:38Z","model":"claude-haiku-5-5","output":{"fix":"- Move WS_FTP Server to `2024.0.6` or later on the 2024.0 line, or `2025.0.3` or later on the 2025.0 line.","reach":"network","title":"WS_FTP Server: Ad Hoc Transfer path flaw exposes files outside intended directories","impact":"medium","summary":"Progress WS_FTP Server's Ad Hoc Transfer component does not properly limit pathnames on Windows, so an authenticated user can reach files outside their intended directories. The sources rate it CVSS 7.7 (high).","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ws_ftp","windows","file-transfer"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads files outside their assigned directories","analyst_note":"","how_to_check":"- Check the installed WS_FTP Server version against the fixed releases listed in the fix section.\n- Confirm whether the Ad Hoc Transfer feature is in use on the server.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","non-windows-host"],"who_is_affected":"Any Windows server running WS_FTP Server before 2024.0.6 or 2025.0.3 is exposed, and the attacker must already hold a valid user account. The sources do not say whether Ad Hoc Transfer must be enabled to be vulnerable, so treat it as in scope when the feature is present. Servers running other versions or non-Windows hosts are not covered by this description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4113,"output_tokens":575,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-84294':16A,19A '2024.0.6':80C '2025.0.3':82C '7.7':59B 'access':91C 'ad':4A,32B,67C 'allow':86C 'authent':45B,88C 'compon':35B,70C 'could':85C 'cve':14A,17A 'cvss':58B 'directori':13A,53B,95C 'expos':9A 'file':10A,21B,49B,92C 'file-transf':20B 'flaw':8A 'ftp':2A,26B,29B,75C 'high':60B 'hoc':5A,33B,68C 'improp':61C 'infrastructur':23B 'intend':12A,52B,94C 'limit':39B,62C 'outsid':11A,50B,93C 'path':7A 'pathnam':40B,64C 'prior':78C 'progress':27B,72C 'proper':38B 'rate':56B 'reach':48B 'server':3A,30B,76C 'softwar':73C 'sourc':55B 'transfer':6A,22B,34B,69C 'user':46B,89C 'version':77C 'window':24B,42B,84C 'ws':1A,25B,28B,74C","nicknames":[],"mitigations":[],"who_affected":"Any Windows server running WS_FTP Server before 2024.0.6 or 2025.0.3 is exposed, and the attacker must already hold a valid user account. The sources do not say whether Ad Hoc Transfer must be enabled to be vulnerable, so treat it as in scope when the feature is present. Servers running other versions or non-Windows hosts are not covered by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:19:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84294","severity":null,"published_at":"2026-10-29T16:19:29+00:00","modified_at":"2026-10-29T16:24:53+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","fetched_at":"2026-10-29T16:26:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}