An OS command injection vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker to execute arbitrary commands with elevated privileges under certain configurations. The vulnerability has a critical CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability.