WS_FTP Server (Prior to 2024.0.6 and 2025.0.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ws_ftp-server-prior-to-2024.0.6-and-2025.0.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 17:50:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgProgress Software WS_FTP Server: Path Traversal in Ad Hoc Transfer (CVE-2026-84294)https://feed.craftedsignal.io/briefs/2026-10-progress-ws-ftp-traversal/Thu, 29 Oct 2026 17:50:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-progress-ws-ftp-traversal/An authenticated path traversal vulnerability in the Ad Hoc Transfer component of Progress Software WS_FTP Server allows unauthorized access to files outside of intended directories.Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 are vulnerable to a path traversal issue (CVE-2026-84294) located in the Ad Hoc Transfer component. An authenticated attacker can manipulate pathnames to access files residing outside the intended directory structure on the underlying Windows host.

Impact

Successful exploitation allows an authenticated user to perform unauthorized file system reads, potentially resulting in the disclosure of sensitive configuration files, user data, or system information.

Recommendation

  • Immediately upgrade WS_FTP Server to version 2024.0.6 or 2025.0.3 to remediate CVE-2026-84294.
  • Review access logs for the Ad Hoc Transfer component for abnormal directory traversal characters (e.g., '..\', '../') in requests from authenticated users.
  • Restrict access to the Ad Hoc Transfer module to the minimum set of necessary users until patching is completed.
]]>criticaladvisorypath-traversalfile-accesswindows