{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ws_ftp-server--2024.0.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*","cpe:2.3:a:progress_software:ws_ftp_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-84294"},{"cvss":10,"id":"CVE-2026-84295"},{"cvss":4.3,"id":"CVE-2026-90862"},{"id":"CVE-2026-90868"},{"id":"CVE-2026-90865"},{"id":"CVE-2026-90872"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WS_FTP Server (\u003c 2024.0.6, \u003c 2025.0.3)","WS_FTP Server (prior to 2024.0.6 and 2025.0.3)","WS_FTP Server (\u003c 2024.0.7)","WS_FTP Server (\u003c 2025.0.4)"],"_cs_severities":["critical"],"_cs_tags":["path-traversal","file-access","windows"],"_cs_type":"advisory","_cs_vendors":["Progress Software"],"content_html":"\u003cp\u003eProgress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 are vulnerable to a path traversal issue (CVE-2026-84294) located in the Ad Hoc Transfer component. An authenticated attacker can manipulate pathnames to access files residing outside the intended directory structure on the underlying Windows host.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to perform unauthorized file system reads, potentially resulting in the disclosure of sensitive configuration files, user data, or system information.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade WS_FTP Server to version 2024.0.6 or 2025.0.3 to remediate CVE-2026-84294.\u003c/li\u003e\n\u003cli\u003eReview access logs for the Ad Hoc Transfer component for abnormal directory traversal characters (e.g., '..\\', '../') in requests from authenticated users.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Ad Hoc Transfer module to the minimum set of necessary users until patching is completed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T18:42:09Z","date_published":"2026-10-29T17:50:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-progress-ws-ftp-traversal/","summary":"An authenticated path traversal vulnerability in the Ad Hoc Transfer component of Progress Software WS_FTP Server allows unauthorized access to files outside of intended directories.","title":"Progress Software WS_FTP Server: Path Traversal in Ad Hoc Transfer (CVE-2026-84294)","url":"https://feed.craftedsignal.io/briefs/2026-10-progress-ws-ftp-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - WS_FTP Server (\u003c 2024.0.7)","version":"https://jsonfeed.org/version/1.1"}