Description
Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.
Published: 2026-11-09
Score: 7.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Workaround

Restrict network access to the Thin Client Web Transfer HTTPS endpoint to trusted hosts, or disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
Description Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.
Title Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server
Weaknesses CWE-22
CWE-862
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-11-09T17:34:41.660Z

Reserved: 2026-10-22T10:41:55.071Z

Link: CVE-2026-115341

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-09T17:17:11.663

Modified: 2026-11-09T17:17:11.770

Link: CVE-2026-115341

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-862

    Missing Authorization