CVE-2026-1153417.7High
CVE-2026-115341: Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server
Progress Software · WS_FTP Server
Vendor fix available · Affected: Progress Software WS_FTP Server · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.09 (9 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
7.7HighCVSS
LowMediumHighCrit.
DescriptionNVD
Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 10 Nov.
- Progress fixes five WS_FTP Server flaws exposing sensitive dataSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.