CVE-2026-90864

Summary

A path traversal flaw in Progress WS_FTP Server allows a delegated Host Administrator to escape their restricted directory scope and read or overwrite arbitrary files on the Windows host by manipulating file paths with sequences like ../

Exploitability

Exploitation requires valid credentials for a delegated Host Administrator role and knowledge of the vulnerable FTP endpoint; no public exploit exists, but the attack is straightforward for an authenticated insider with elevated privileges

Blast radius

An attacker could exfiltrate sensitive configuration files, inject malicious code into system services, or corrupt critical data, potentially leading to full system compromise or persistent backdoor deployment within the affected server environment

Detection

Monitor FTP server logs for Host Administrator sessions that include file operations with path components containing '..' or absolute paths outside the user's designated home directory; alert on such patterns in access logs or audit trails

Prioritized remediation

Upgrade to WS_FTP Server version 2024.0.7 or 2025.0.4 immediately; these versions contain the vendor's official fix for the path traversal vulnerability

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.