CVE-2026-115341

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115341", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-10-22T10:41:55.071Z", "datePublished": "2026-11-09T16:45:53.170Z", "dateUpdated": "2026-11-09T17:34:41.660Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-11-09T16:45:53.170Z"}, "title": "Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}, {"lang": "en", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Path Traversal"}]}], "affected": [{"vendor": "Progress Software", "product": "WS_FTP Server", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThan": "2025.0.5", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope."}]}], "references": [{"url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}}], "workarounds": [{"lang": "en", "value": "Restrict network access to the Thin Client Web Transfer HTTPS endpoint to trusted hosts, or disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>Restrict network access to the Thin Client Web Transfer HTTPS endpoint to trusted hosts, or disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.</div>"}]}], "credits": [{"lang": "en", "value": "Mateusz Mieczkowski (rexnets)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115341", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T17:11:27.817666Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:34:41.660Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115341", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T17:11:27.817666Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:24:29.548Z"}}], "cna": {"title": "Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Mateusz Mieczkowski (rexnets)"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software", "product": "WS_FTP Server", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.0.5", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Restrict network access to the Thin Client Web Transfer HTTPS endpoint to trusted hosts, or disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.", "supportingMedia": [{"type": "text/html", "value": "<div>Restrict network access to the Thin Client Web Transfer HTTPS endpoint to trusted hosts, or disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.</div>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.", "supportingMedia": [{"type": "text/html", "value": "Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}, {"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-11-09T16:45:53.170Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115341", "state": "PUBLISHED", "dateUpdated": "2026-11-09T17:34:41.660Z", "dateReserved": "2026-10-22T10:41:55.071Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2026-11-09T16:45:53.170Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "WS_FTP Server", "vendor": "Progress Software", "versions": [{"lessThan": "2025.0.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "security@progress.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope."}], "id": "CVE-2026-115341", "lastModified": "2026-11-09T18:17:21.257", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security@progress.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115341", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T17:11:27.817666Z", "version": "2.0.3"}}]}, "published": "2026-11-09T17:17:11.663", "references": [{"source": "security@progress.com", "url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-862"}], "source": "security@progress.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,2025.0.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WS_FTP Server", "source": "cna", "vendor": "Progress Software"}, "product": "ws_ftp_server", "vendor": "progress"}, {"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,2025.0.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WS_FTP Server", "source": "cna", "vendor": "Progress Software"}, "product": "ws_ftp_server", "vendor": "progress_software"}], "created": "2026-11-09T18:30:13.373237+00:00", "updated": "2026-11-09T18:45:11.591431+00:00", "vendors": ["progress", "progress$PRODUCT$ws_ftp_server", "progress_software", "progress_software$PRODUCT$ws_ftp_server"]}