---
id: "CVE-2026-84294"
kind: "vulnerability"
aliases: ["CVE-2026-84294"]
title: "WS_FTP Server: Ad Hoc Transfer path flaw exposes files outside intended directories"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["file-transfer", "infrastructure", "windows", "ws_ftp"]
not_affected_if: ["non-windows-host", "patched-version"]
published_at: "2026-10-29T16:19:29+00:00"
first_seen_at: "2026-10-29T16:26:01+00:00"
updated_at: "2026-10-29T16:29:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84294", "first_seen_at": "2026-10-29T16:26:01+00:00"}]
---

# WS_FTP Server: Ad Hoc Transfer path flaw exposes files outside intended directories

Progress WS_FTP Server's Ad Hoc Transfer component does not properly limit pathnames on Windows, so an authenticated user can reach files outside their intended directories. The sources rate it CVSS 7.7 (high).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WS_FTP Server version against the fixed releases listed in the fix section.
- Confirm whether the Ad Hoc Transfer feature is in use on the server.

## Fix

- Move WS_FTP Server to `2024.0.6` or later on the 2024.0 line, or `2025.0.3` or later on the 2025.0 line.

## Timeline

- 2026-10-29T16:26:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84294

## From the sources

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_