{"id":"CVE-2026-90864","kind":"vulnerability","aliases":["CVE-2026-90864"],"related":[],"title":"WS_FTP Server: path traversal lets delegated host admin reach files outside scope","description":"A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.","summary":"WS_FTP Server on Windows has a path traversal flaw that lets a delegated Host Administrator access or modify files outside their authorized scope. The sources report a CVSS score of 9.1 but do not describe the exploit path in detail.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","runtime","windows","ws_ftp_server"],"not_affected_if":["non-windows-install"],"how_to_check":"- Check the installed WS_FTP Server version in the product's admin console or installed programs list on Windows.\n- Compare it against the affected ranges: prior to `2024.0.7` and prior to `2025.0.4`.","fix":"- WS_FTP Server versions `2024.0.7` and `2025.0.4` (fixed versions named in the advisory description; move to the matching release line).","status":"open","published_at":"2026-10-29T16:20:04+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","triaged_at":"2026-10-29T16:27:48+00:00","updated_at":"2026-10-29T16:27:48+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-29T16:27:48Z","model":"claude-haiku-5-5","output":{"fix":"- WS_FTP Server versions `2024.0.7` and `2025.0.4` (fixed versions named in the advisory description; move to the matching release line).","reach":"unknown","title":"WS_FTP Server: path traversal lets delegated host admin reach files outside scope","impact":"high","summary":"WS_FTP Server on Windows has a path traversal flaw that lets a delegated Host Administrator access or modify files outside their authorized scope. The sources report a CVSS score of 9.1 but do not describe the exploit path in detail.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ws_ftp_server","windows","file-transfer"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"delegated admin reads or modifies files outside their scope","analyst_note":"Confirm the fixed version ranges and whether the flaw is reachable beyond delegated admins; the NVD entry alone gives no exploit detail.","how_to_check":"- Check the installed WS_FTP Server version in the product's admin console or installed programs list on Windows.\n- Compare it against the affected ranges: prior to `2024.0.7` and prior to `2025.0.4`.","plain_action":"","needs_analyst":true,"not_affected_if":["non-windows-install"],"who_is_affected":"Teams that run WS_FTP Server on Windows and have delegated Host Administrator roles. The sources only name delegated Host Administrators as the attacker role, so installs without delegated admins may have less exposure, but the sources do not say this. Unknown whether the flaw is reachable from the internet by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000712,"input_tokens":4117,"output_tokens":601,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-90864':16A,19A '2024.0.7':82C '2025.0.4':84C '9.1':59B 'access':44B,94C 'admin':9A 'administr':43B,92C 'allow':88C 'author':50B,100C 'could':87C 'cve':14A,17A 'cvss':56B 'deleg':7A,41B,90C 'describ':63B 'detail':68B 'exploit':65B 'file':11A,21B,47B,97C 'file-transf':20B 'flaw':37B 'ftp':2A,26B,29B,77C 'host':8A,42B,91C 'let':6A,39B 'modifi':46B,96C 'outsid':12A,48B,98C 'path':4A,35B,66B,70C 'prior':80C 'progress':74C 'reach':10A 'report':54B 'runtim':23B 'scope':13A,51B,101C 'score':57B 'server':3A,27B,30B,78C 'softwar':75C 'sourc':53B 'transfer':22B 'travers':5A,36B,71C 'version':79C 'vulner':72C 'window':24B,32B,86C 'ws':1A,25B,28B,76C","nicknames":[],"mitigations":[],"who_affected":"Teams that run WS_FTP Server on Windows and have delegated Host Administrator roles. The sources only name delegated Host Administrators as the attacker role, so installs without delegated admins may have less exposure, but the sources do not say this. Unknown whether the flaw is reachable from the internet by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:20:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90864","severity":null,"published_at":"2026-10-29T16:20:04+00:00","modified_at":"2026-10-29T16:24:53+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","fetched_at":"2026-10-29T16:26:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}