WS_FTP Server CVE-2026-84294

Requires a valid authenticated WS_FTP Server account (PR:L) and that the Ad Hoc Transfer component is in use; the deployment must be WS_FTP Server on Windows running a version prior to 2024.0.6 (2024 branch) or prior to 2025.0.3 (2025 branch). The dominant limiting factor is authentication - an attacker must already possess working credentials, so this cannot be triggered by an unauthenticated remote attacker. Impact is read-only disclosure of files outside the intended directory (confidentiality only); there is no integrity or availability effect. The precise traversal mechanism (e.g. the exact malformed pathname that triggers it) is not described in the available sources.

This is a credentialed information-disclosure flaw (CWE-22 path traversal) rated CVSS 7.7. The supplied vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N indicates network-reachable, low-complexity exploitation with no user interaction, but it explicitly requires an authenticated account (PR:L), and the impact is confined to confidentiality (C:H) with no integrity or availability effect (I:N/A:N). The scope-changed flag (S:C) reflects that a successful traversal reads files outside the application's intended directory boundary, i.e. the underlying Windows host filesystem rather than only the user's authorized FTP area. No EPSS probability was supplied, the CVE is NOT in CISA KEV, and no proof-of-concept or exploit reference is present in the input - only a Progress vendor knowledge-base advisory. Exploitation status is therefore 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week,' which places it as a near-term but non-emergency patching priority - consistent with a high-confidentiality but authentication-gated bug rather than an unauthenticated internet-wide threat. The authentication requirement is the dominant mitigating factor: this is a real priority to patch (especially given that Progress file-transfer products such as MOVEit have been heavily targeted historically), but the PR:L gate makes mass, pre-auth exploitation unlikely, pointing toward abuse by malicious or compromised authenticated users rather than opportunistic internet scanning. Missing signals: EPSS and any independent exploitation telemetry are absent, so widespread-exploitation likelihood cannot be quantified from the data provided.

An attacker who holds (or has stolen) a valid WS_FTP Server account logs in and uses the Ad Hoc Transfer component to submit a crafted pathname containing directory-traversal sequences. Because the path is not properly constrained, the server returns files located outside the user's authorized directory - potentially configuration, credential, or other sensitive host files on the Windows system. No public exploit code was identified in the provided data; the only reference is a Progress vendor advisory.