CVE-2023-42657

9.6 criticalEPSS 16%

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path. Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system.

Severity

CVSS 3.1

9.6 critical

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

EPSS: 16% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2023-09-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

progress:ws_ftp_server

References

https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
https://www.progress.com/ws_ftp
https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
https://www.progress.com/ws_ftp

Check your stack JSON