Path traversal in WS_FTP - CVE-2026-90866
Published: October 29, 2026
Vulnerability identifier: #VU158497
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90866
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to bypass virtual folder confinement and potentially access or modify files outside their assigned scope.
The vulnerability exists due to path traversal and insufficient restrictions on dangerous file uploads in the virtual folder functionality of Progress WS_FTP Server when handling file paths and uploads. A remote privileged user can supply paths outside the intended virtual folder boundary to potentially access or modify files beyond their assigned scope.
Affected software
WS_FTP
How to mitigate CVE-2026-90866
Install security update from vendor's website.
WS_FTP - addressed in versions 9.0.7, 10.0.4