WS_FTP Server CVE-2026-90871

No special product feature or non-default setting is called out: the description indicates an unauthenticated attacker (PR:N) can exploit the flaw over the network (AV:N) against WS_FTP Server, but exploitation is constrained to the Windows platform ('on Windows') and to affecting files outside the intended directory with only LOW integrity impact (C:N/I:L/A:N) - no code execution, data disclosure, or availability loss is indicated. The practical limiting factors are platform (Windows-only), the bounded file-manipulation primitive, and the requirement that the server be network-reachable; the exact traversal trigger is not described in the available sources.

This is a moderate-severity path traversal (CWE-22) with a vendor-aligned CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning network-reachable, low-complexity, unauthenticated exploitation but with only a LOW integrity impact and no confidentiality or availability impact. The decision framework signal is 'this_month' priority, which is consistent with a non-emergency, patchable issue rather than an active crisis. No EPSS score, no CISA KEV listing, and no public exploit reference are present in the provided data, so there is no evidence of active exploitation or available weaponized code at this time - exploitation status is 'no public exploit identified at time of analysis.' The main caveat is a description/vector tension: the phrase 'affect files outside the intended directory' is ambiguous as to whether it enables read (confidentiality) or write (integrity), yet the vector scores C:N and I:L only; the limited single-impact scoring suggests constrained file manipulation rather than full arbitrary file read/write - verify the exact primitive with the Progress advisory. Overall this reads as a genuine but bounded issue: easy to reach but low blast radius, warranting scheduled patching rather than emergency response, especially given WS_FTP Server's history of being targeted after disclosure.

A remote, unauthenticated attacker sends a crafted request to an internet-exposed WS_FTP Server on Windows that manipulates a pathname to escape the intended directory, allowing them to affect files outside that restricted location. No public exploit code is identified in the available data, and the low-complexity network vector (AV:N/AC:L) means no special timing or user interaction is required.