{"id":"CVE-2026-84294","aliases":[],"cve":{"records":[{"id":"CVE-2026-84294","source":"ProgressSoftware","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-01T16:14:45.351Z","published":"2026-10-29T15:42:44.195Z","modified":"2026-10-29T15:43:29.463Z"}],"publishers":[{"name":"ProgressSoftware","role":"CNA","organizationId":"f9fea0b6-671e-4eea-8fde-31911902ae05","modified":"2026-10-29T15:43:29.463Z"}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","tags":["vendor-advisory"],"source":"ProgressSoftware"}],"weaknesses":[{"id":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","source":"ProgressSoftware"}],"applicability":[],"prioritization":[]},"title":"Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server","titleSource":"ProgressSoftware","descriptionSource":"ProgressSoftware","description":"Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.","score":7.7,"severity":"high","published":"2026-10-29T15:42:44.195Z","modified":"2026-10-29T15:43:29.463Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Progress Software","name":"WS_FTP Server","platforms":["Windows"],"versions":[{"version":"0","status":"affected","lessThan":"2024.0.6","versionType":"custom"},{"version":"0","status":"affected","lessThan":"2025.0.3","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"ProgressSoftware","url":"https://www.cve.org/CVERecord?id=CVE-2026-84294"}],"remediation":[{"text":"Restrict Ad Hoc Transfer functionality to trusted users, or disable it if not required. Apply least-privilege permissions to relevant service accounts.","source":"ProgressSoftware","url":"https://www.cve.org/CVERecord?id=CVE-2026-84294"}],"references":["https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"],"sources":[{"name":"CVE","id":"CVE-2026-84294","modified":"2026-10-29T15:43:29.463Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-84294"}],"assessments":[{"source":"ProgressSoftware","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7}],"sourceAffected":[],"observedAt":"2026-10-29T16:10:45.407Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T08:35:32.065Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T16:20:34.952Z","attemptedAt":"2026-10-29T16:20:34.952Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T16:20:34.752Z","attemptedAt":"2026-10-29T16:20:34.752Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T16:20:34.567Z","attemptedAt":"2026-10-29T16:20:34.567Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T16:20:35.959Z","attemptedAt":"2026-10-29T16:20:35.959Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113010","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113010","modified":"Oct 29, 2026, 3:43:29 PM","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","checkedAt":"2026-10-29T16:20:34.567Z"},{"source":"NVD","id":"CVE-2026-84294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84294","modified":"2026-10-29T16:19:29.237","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","checkedAt":"2026-10-29T16:20:34.952Z"}],"aiSummary":{"text":"Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows have an improper limitation of pathname in the Ad Hoc Transfer component, allowing an authenticated user to access files outside intended directories. The weakness is due to a path traversal issue. An attacker needs authenticated access to exploit this vulnerability.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T10:02:32.352Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-84294"}]}}