Path traversal in WS_FTP - CVE-2026-90864
Published: October 29, 2026
Vulnerability identifier: #VU158499
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90864
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to bypass host administrator path restrictions and potentially access or modify files outside their authorized scope.
The vulnerability exists due to path traversal and insufficient restrictions on dangerous file uploads in the host administration functionality of Progress WS_FTP Server when handling file paths and uploads. A remote privileged user can supply paths that escape the intended containment boundary to potentially access or modify files outside their authorized scope.
Affected software
WS_FTP
How to mitigate CVE-2026-90864
Install security update from vendor's website.
WS_FTP - addressed in versions 9.0.7, 10.0.4