This vulnerability stems from incorrect quota accounting in Progress Software WS_FTP Server versions released before 2025.0.5 on Windows. An authenticated user who possesses both upload and delete permissions can upload files in excess of the allotted storage quota. Such over‑quota activity can cause the server to run out of available storage space, resulting in service interruption or degradation. The weakness is classified as CWE‑682, indicating a failure to enforce or maintain a resource limit.

The affected product is Progress Software WS_FTP Server. All releases prior to the 2025.0.5 update running on Windows are susceptible to the misuse of upload and delete permissions to circumvent stored quota limits. Specific version details are not listed beyond the general pre‑2025.0.5 baseline.

The CVSS score of 6.5 reflects a moderate severity vulnerability that requires authentication. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating a limited current exploitation footprint. However, since the exploit requires legitimate credentials and grants both upload and delete access, an insider or compromised account could exploit the flaw to deplete available disk space and trigger a denial of service. The risk remains significant for organizations that rely on strict storage limits for compliance or performance reasons.