Threats affecting pkg:maven/com.progress/ws_ftp_server

Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.

CVE-2026-115336 is a vulnerability in Progress Software WS_FTP Server on Windows where incorrect quota accounting allows authenticated users with upload and delete permissions to exceed storage quotas. This flaw affects versions from 2025.0.0 up to but not including 2025.0.5. Exploitation could lead to denial of service by exhausting storage resources. The issue is fixed in version 2025.0.5.

Progress Software WS_FTP Server versions prior to 2025.0.5 have insufficient protection for communications when unencrypted connections are used. This vulnerability could allow a network attacker to intercept sensitive information or modify requests. The issue is addressed in version 2025.0.5.

An OS command injection vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker with limited privileges to execute arbitrary commands, potentially leading to full system compromise. The vulnerability is rated critical with a CVSS score of 9.9.

A resource management flaw exists in the Ad Hoc Transfer component of Progress Software WS_FTP Server on Windows, where backend receiver sessions are not properly released. This issue affects versions prior to 2024.0.7 and 2025.0.4 and can cause server resource exhaustion leading to service degradation.

An OS command injection vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker to execute arbitrary commands with elevated privileges under certain configurations. The vulnerability has a critical CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability.

A vulnerability in Progress Software WS_FTP Server on Windows allows a remote attacker who knows a valid account's enrolled SSH public key to terminate the shared SSH service. This affects versions prior to 2024.0.7 and 2025.0.4. The vulnerability has a high severity score and impacts availability without affecting confidentiality or integrity.