{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-90866",
        "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "state": "PUBLISHED",
        "assignerShortName": "ProgressSoftware",
        "dateReserved": "2026-09-14T06:09:55.847Z",
        "datePublished": "2026-10-29T15:52:24.790Z",
        "dateUpdated": "2026-10-30T03:56:40.699Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
                "shortName": "ProgressSoftware",
                "dateUpdated": "2026-10-29T15:52:24.790Z"
            },
            "title": "Virtual Folder Path Confinement Bypass in Progress WS_FTP Server",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-22",
                            "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                            "type": "CWE"
                        },
                        {
                            "lang": "en",
                            "cweId": "CWE-434",
                            "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "impacts": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "Path Traversal - may allow a delegated administrator to escape their assigned host root and achieve remote code execution"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "Progress Software",
                    "product": "WS_FTP Server",
                    "platforms": [
                        "Windows"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "2024.0.7",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "2025.0.4",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution."
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view",
                    "tags": [
                        "vendor-advisory"
                    ]
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV3_1": {
                        "version": "3.1",
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "privilegesRequired": "HIGH",
                        "userInteraction": "NONE",
                        "scope": "CHANGED",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "HIGH",
                        "availabilityImpact": "HIGH",
                        "baseSeverity": "CRITICAL",
                        "baseScore": 9.1,
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
                    }
                }
            ],
            "workarounds": [
                {
                    "lang": "en",
                    "value": "Limit delegation of Host Administrator privileges to trusted staff, and periodically audit virtual folder physical paths to confirm they remain within their assigned host root. Contact Progress Software Technical Support for guidance on available mitigations.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<div>Limit delegation of Host Administrator privileges to trusted staff, and periodically audit virtual folder physical paths to confirm they remain within their assigned host root. Contact Progress Software Technical Support for guidance on available mitigations.</div>"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Niv Levy (restricted)",
                    "type": "finder"
                }
            ],
            "source": {
                "discovery": "EXTERNAL"
            },
            "x_generator": {
                "engine": "Vulnogram 0.2.0"
            }
        },
        "adp": [
            {
                "title": "CISA ADP Vulnrichment",
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-10-29T00:00:00+00:00",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3",
                                "id": "CVE-2026-90866"
                            }
                        }
                    }
                ],
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-10-30T03:56:40.699Z"
                }
            }
        ]
    }
}