Progress Software WS_FTP Server: Path traversal in Thin Client Web Transfer (CVE-2026-115341)
An improper access restriction vulnerability in the Thin Client Web Transfer component of Progress Software WS_FTP Server allows authenticated users to perform unauthorized path traversal to access files outside their intended scope.
CVE search metadata
CVE search record: CVE-2026-115341. Severity: high. CVSS: 7.7. KEV: no. Product: WS_FTP Server (< 2025.0.5). Brief: Progress Software WS_FTP Server: Path traversal in Thin Client Web Transfer (CVE-2026-115341). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ws-ftp-traversal/
Triage facts
Revision 1- Applicability
- WS_FTP Server (< 2025.0.5)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 19:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Progress Software WS_FTP Server versions prior to 2025.0.5 contain a vulnerability in the Thin Client Web Transfer component. An authenticated user can exploit improper access restrictions to access files outside of their designated directory boundaries. This vulnerability is assigned CVE-2026-115341.
Impact
Authenticated attackers may gain unauthorized access to sensitive files on the underlying Windows filesystem that are otherwise restricted by the application configuration.
Recommendation
Update Progress Software WS_FTP Server to version 2025.0.5 or later. Organizations should monitor Thin Client Web Transfer logs for directory traversal patterns such as "../" sequences in request paths from authenticated user sessions.
Immediate actions
Upgrade Progress Software WS_FTP Server to 2025.0.5 or later
Threat Hunt
Hunt for directory traversal sequences within application logs for the Thin Client Web Transfer component
Data: WS_FTP Server application access logs
Mitigations
Apply patch 2025.0.5 to all WS_FTP Server instances
CVE-2026-115341