Progress Software WS_FTP Server: Path Traversal in Ad Hoc Transfer (CVE-2026-84294)
An authenticated path traversal vulnerability in the Ad Hoc Transfer component of Progress Software WS_FTP Server allows unauthorized access to files outside of intended directories.
CVE search metadata
CVE search record: CVE-2026-84294. Severity: high. CVSS: 7.7. KEV: no. Product: WS_FTP Server (< 2024.0.6, < 2025.0.3), WS_FTP Server (prior to 2024.0.6 and 2025.0.3), WS_FTP Server (< 2024.0.7), WS_FTP Server (< 2025.0.4). Brief: Progress Software WS_FTP Server: Path Traversal in Ad Hoc Transfer (CVE-2026-84294). Brief link: https://feed.craftedsignal.io/briefs/2026-10-progress-ws-ftp-traversal/
CVE search record: CVE-2026-84295. Severity: critical. CVSS: 10.0. KEV: no. Product: WS_FTP Server (< 2024.0.6, < 2025.0.3), WS_FTP Server (prior to 2024.0.6 and 2025.0.3), WS_FTP Server (< 2024.0.7), WS_FTP Server (< 2025.0.4). Brief: Progress Software WS_FTP Server: Path Traversal in Ad Hoc Transfer (CVE-2026-84294). Brief link: https://feed.craftedsignal.io/briefs/2026-10-progress-ws-ftp-traversal/
CVE search record: CVE-2026-90862. Severity: medium. CVSS: 4.3. KEV: no. Product: WS_FTP Server (< 2024.0.6, < 2025.0.3), WS_FTP Server (prior to 2024.0.6 and 2025.0.3), WS_FTP Server (< 2024.0.7), WS_FTP Server (< 2025.0.4). Brief: Progress Software WS_FTP Server: Path Traversal in Ad Hoc Transfer (CVE-2026-84294). Brief link: https://feed.craftedsignal.io/briefs/2026-10-progress-ws-ftp-traversal/
CVE search record: CVE-2026-90868. KEV: no. Product: WS_FTP Server (< 2024.0.6, < 2025.0.3), WS_FTP Server (prior to 2024.0.6 and 2025.0.3), WS_FTP Server (< 2024.0.7), WS_FTP Server (< 2025.0.4). Brief: Progress Software WS_FTP Server: Path Traversal in Ad Hoc Transfer (CVE-2026-84294). Brief link: https://feed.craftedsignal.io/briefs/2026-10-progress-ws-ftp-traversal/
CVE search record: CVE-2026-90865. KEV: no. Product: WS_FTP Server (< 2024.0.6, < 2025.0.3), WS_FTP Server (prior to 2024.0.6 and 2025.0.3), WS_FTP Server (< 2024.0.7), WS_FTP Server (< 2025.0.4). Brief: Progress Software WS_FTP Server: Path Traversal in Ad Hoc Transfer (CVE-2026-84294). Brief link: https://feed.craftedsignal.io/briefs/2026-10-progress-ws-ftp-traversal/
CVE search record: CVE-2026-90872. KEV: no. Product: WS_FTP Server (< 2024.0.6, < 2025.0.3), WS_FTP Server (prior to 2024.0.6 and 2025.0.3), WS_FTP Server (< 2024.0.7), WS_FTP Server (< 2025.0.4). Brief: Progress Software WS_FTP Server: Path Traversal in Ad Hoc Transfer (CVE-2026-84294). Brief link: https://feed.craftedsignal.io/briefs/2026-10-progress-ws-ftp-traversal/
Triage facts
Revision 2- Applicability
- WS_FTP Server (< 2024.0.6, < 2025.0.3), WS_FTP Server (prior to 2024.0.6 and 2025.0.3) +2
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 9 public sources
- Freshness
- Revision 2Oct 29, 18:44 UTC
- Vulnerabilities
- 6 CVEs
- Source quality
- A5Likely
Revision history 1 entry · Revision 2
- Revision 2
added CVE-2026-90862
Changed: affected_products, claim_state, cves, lastmod, references, updates
Sources: 1
Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 are vulnerable to a path traversal issue (CVE-2026-84294) located in the Ad Hoc Transfer component. An authenticated attacker can manipulate pathnames to access files residing outside the intended directory structure on the underlying Windows host.
Impact
Successful exploitation allows an authenticated user to perform unauthorized file system reads, potentially resulting in the disclosure of sensitive configuration files, user data, or system information.
Recommendation
- Immediately upgrade WS_FTP Server to version 2024.0.6 or 2025.0.3 to remediate CVE-2026-84294.
- Review access logs for the Ad Hoc Transfer component for abnormal directory traversal characters (e.g., '..\', '../') in requests from authenticated users.
- Restrict access to the Ad Hoc Transfer module to the minimum set of necessary users until patching is completed.
Immediate actions
Patch WS_FTP Server to 2024.0.6 or 2025.0.3
Threat Hunt
Search for path traversal sequences in application-level logs for WS_FTP Ad Hoc Transfer
Data: WS_FTP Server application request logs
Mitigations
Upgrade to fixed versions
CVE-2026-84294