A vulnerability in the Manager web console of Progress Software WS_FTP Server on Windows allows an authenticated Manager administrator to execute arbitrary commands with the privileges of the IIS worker process. This issue affects versions prior to 2024.0.7 and 2025.0.4. The flaw is due to improper neutralization of directives in dynamically evaluated code.