Live › vulnerability › CVE-2026-90864
WS_FTP Server on Windows has a path traversal flaw that lets a delegated Host Administrator access or modify files outside their authorized scope. The sources report a CVSS score of 9.1 but do not describe the exploit path in detail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Teams that run WS_FTP Server on Windows and have delegated Host Administrator roles. The sources only name delegated Host Administrators as the attacker role, so installs without delegated admins may have less exposure, but the sources do not say this. Unknown whether the flaw is reachable from the internet by default.
No product ranges from the sources yet.
2024.0.7 and prior to 2025.0.4.2024.0.7 and 2025.0.4 (fixed versions named in the advisory description; move to the matching release line).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
This page as .md · .json · in your agent: get_signal("CVE-2026-90864")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.