PT-2026-132377

CVE-2026-90872

·

Published

2026-10-29

·

Updated

2026-10-29

Description by

CVSS 3.1
6.6
Medium
MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS FTP Server IIS worker process.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\'Eval Injection\')
CWE-94: Improper Control of Generation of Code (\'Code Injection\')
Related identifiers
CVE-2026-90872
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com