Progress Software WS_FTP Server versions older than 2025.0.5 may create a temporary file during file transfers that contains sensitive user credentials and session data; if an attacker gains access to that file, they can retrieve authentication information, violating confidentiality and potentially enabling further compromise. The weakness is a form of insecure storage of credentials (CWE-312) combined with missing authentication checks (CWE-522).

Any installation of Progress Software WS_FTP Server running on Windows with a version earlier than 2025.0.5 is susceptible, as the vulnerable code path exists only in those releases.

The CVSS score of 7.1 indicates a high severity, and although EPSS data is unavailable, the lack of vulnerability status in CISA KEV suggests no known active exploitation yet. The attack requires local or remote access sufficient to read the temporary file, so the plausible vector is either a local privileged attacker or an external attacker who can traverse the ad‑hoc transfer endpoint. The workaround of limiting session timeouts and network scope can reduce exposure, but the safest mitigation is to remove the vulnerable code by upgrading.