{"id":"CVE-2026-90866","kind":"vulnerability","aliases":["CVE-2026-90866"],"related":[],"title":"WS_FTP Server: path traversal lets delegated admin reach files outside scope","description":"A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.","summary":"WS_FTP Server on Windows has a path traversal flaw that lets a delegated Host Administrator access locations outside their authorized scope. The sources say this could potentially enable remote code execution.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","infrastructure","windows","ws_ftp_server"],"not_affected_if":["no-delegated-host-admins","non-windows"],"how_to_check":"- Check the installed WS_FTP Server version against the fixed versions listed in the fix section.\n- Confirm whether any accounts hold the delegated Host Administrator role.","fix":"- Move to `2024.0.7` on the 2024 line or `2025.0.4` on the 2025 line.","status":"open","published_at":"2026-10-29T16:20:04+00:00","first_seen_at":"2026-10-29T16:26:02+00:00","triaged_at":"2026-10-29T16:27:46+00:00","updated_at":"2026-10-29T16:27:46+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-29T16:27:46Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `2024.0.7` on the 2024 line or `2025.0.4` on the 2025 line.","reach":"network","title":"WS_FTP Server: path traversal lets delegated admin reach files outside scope","impact":"high","summary":"WS_FTP Server on Windows has a path traversal flaw that lets a delegated Host Administrator access locations outside their authorized scope. The sources say this could potentially enable remote code execution.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ws_ftp_server","windows","file-transfer"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reaches files outside scope and may run code","analyst_note":"Sources list only the NVD entry; check the Progress advisory for exploit details, affected config, and whether the delegated-admin role is required.","how_to_check":"- Check the installed WS_FTP Server version against the fixed versions listed in the fix section.\n- Confirm whether any accounts hold the delegated Host Administrator role.","plain_action":"","needs_analyst":true,"not_affected_if":["no-delegated-host-admins","non-windows"],"who_is_affected":"Servers running WS_FTP Server on Windows before 2024.0.7 or 2025.0.4 are exposed. The flaw is reached through delegated Host Administrator accounts, so installations that do not delegate that role are less exposed. The sources do not say more about configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000688,"input_tokens":4127,"output_tokens":551,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-90866':15A,18A '2024.0.7':72C '2025.0.4':74C 'access':43B,84C 'admin':8A 'administr':42B,82C 'allow':78C 'author':47B,88C 'code':57B,93C 'could':53B,77C 'cve':13A,16A 'deleg':7A,40B,80C 'enabl':55B,91C 'execut':58B,94C 'file':10A,20B 'file-transf':19B 'flaw':36B 'ftp':2A,25B,28B,67C 'host':41B,81C 'infrastructur':22B 'let':6A,38B 'locat':44B,85C 'outsid':11A,45B,86C 'path':4A,34B,60C 'potenti':54B,90C 'prior':70C 'progress':64C 'reach':9A 'remot':56B,92C 'say':51B 'scope':12A,48B,89C 'server':3A,26B,29B,68C 'softwar':65C 'sourc':50B 'transfer':21B 'travers':5A,35B,61C 'version':69C 'vulner':62C 'window':23B,31B,76C 'ws':1A,24B,27B,66C","nicknames":[],"mitigations":[],"who_affected":"Servers running WS_FTP Server on Windows before 2024.0.7 or 2025.0.4 are exposed. The flaw is reached through delegated Host Administrator accounts, so installations that do not delegate that role are less exposed. The sources do not say more about configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:20:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90866","severity":null,"published_at":"2026-10-29T16:20:04+00:00","modified_at":"2026-10-29T16:24:53+00:00","first_seen_at":"2026-10-29T16:26:02+00:00","fetched_at":"2026-10-29T16:26:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}