Live › vulnerability › CVE-2026-90866
WS_FTP Server on Windows has a path traversal flaw that lets a delegated Host Administrator access locations outside their authorized scope. The sources say this could potentially enable remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Servers running WS_FTP Server on Windows before 2024.0.7 or 2025.0.4 are exposed. The flaw is reached through delegated Host Administrator accounts, so installations that do not delegate that role are less exposed. The sources do not say more about configuration.
No product ranges from the sources yet.
2024.0.7 on the 2024 line or 2025.0.4 on the 2025 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-90866")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.