{"api_version":"1","generated_at":"2026-11-10T14:04:40+00:00","cve":"CVE-2026-115341","urls":{"html":"https://cve.report/CVE-2026-115341","api":"https://cve.report/api/cve/CVE-2026-115341.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-115341","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-115341"},"summary":{"title":"Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server","description":"Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.","state":"PUBLISHED","assigner":"ProgressSoftware","published_at":"2026-11-09 17:17:11","updated_at":"2026-11-09 18:17:21"},"problem_types":["CWE-22","CWE-862","CWE-22 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","CWE-862 CWE-862: Missing Authorization"],"metrics":[{"version":"3.1","source":"security@progress.com","type":"Secondary","score":"7.7","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.7","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026","name":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026","refsource":"security@progress.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115341","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115341","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Progress Software","product":"WS_FTP Server","version":"affected 2025.0.5 custom","platforms":["Windows"]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Restrict network access to the Thin Client Web Transfer HTTPS endpoint to trusted hosts, or disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Mateusz Mieczkowski (rexnets)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-115341","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:11:27.817666Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-09T17:34:41.660Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"WS_FTP Server","vendor":"Progress Software","versions":[{"lessThan":"2025.0.5","status":"affected","version":"0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"Mateusz Mieczkowski (rexnets)"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope."}],"value":"Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope."}],"impacts":[{"descriptions":[{"lang":"en","value":"Path Traversal"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"},{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-09T16:45:53.170Z","orgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","shortName":"ProgressSoftware"},"references":[{"tags":["vendor-advisory"],"url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"}],"source":{"discovery":"EXTERNAL"},"title":"Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div>Restrict network access to the Thin Client Web Transfer HTTPS endpoint to trusted hosts, or disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.</div>"}],"value":"Restrict network access to the Thin Client Web Transfer HTTPS endpoint to trusted hosts, or disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations."}],"x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","assignerShortName":"ProgressSoftware","cveId":"CVE-2026-115341","datePublished":"2026-11-09T16:45:53.170Z","dateReserved":"2026-10-22T10:41:55.071Z","dateUpdated":"2026-11-09T17:34:41.660Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-09 17:17:11","lastModifiedDate":"2026-11-09 18:17:21","problem_types":["CWE-22","CWE-862","CWE-22 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","CWE-862 CWE-862: Missing Authorization"],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-09T17:11:27.817666Z","id":"CVE-2026-115341","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"115341","Ordinal":"1","Title":"Unauthorized File Disclosure via Path Traversal in Thin Client W","CVE":"CVE-2026-115341","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"115341","Ordinal":"1","NoteData":"Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.","Type":"Description","Title":"Unauthorized File Disclosure via Path Traversal in Thin Client W"}]}}}