Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…
Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Progress Software
- Product
- WS_FTP Server
- CVSS v3.1
- 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-22, CWE-73
- Exposure class
- File transfer
- NVD status
- Awaiting Analysis
Why it ranks 21 (Routine)
- CVSS v3.1 5.3 medium
- Exposed product class: file transfer
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-90871 on this site · NVD · CVE.org · Vulnpedia