{"id":"CVE-2026-90864","published":"2026-10-29T16:20:04.453","lastModified":"2026-10-30T04:18:28.927","description":"A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-22","CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A path traversal flaw in Progress WS_FTP Server allows a delegated Host Administrator to escape their restricted directory scope and read or overwrite arbitrary files on the Windows host by manipulating file paths with sequences like ../","exploitability":"Exploitation requires valid credentials for a delegated Host Administrator role and knowledge of the vulnerable FTP endpoint; no public exploit exists, but the attack is straightforward for an authenticated insider with elevated privileges","blast_radius":"An attacker could exfiltrate sensitive configuration files, inject malicious code into system services, or corrupt critical data, potentially leading to full system compromise or persistent backdoor deployment within the affected server environment","remediation":"Upgrade to WS_FTP Server version 2024.0.7 or 2025.0.4 immediately; these versions contain the vendor's official fix for the path traversal vulnerability","detection":"Monitor FTP server logs for Host Administrator sessions that include file operations with path components containing '..' or absolute paths outside the user's designated home directory; alert on such patterns in access logs or audit trails","tags":["path-traversal","privilege-escalation","insider-threat","ftp","windows"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:20:03.961Z"}}