The vulnerability resides in the Thin Client Web Transfer component of Progress Software WS_FTP Server and is a path traversal flaw that permits an authenticated FTP user to read files beyond the intended directory scope. This results in unauthorized disclosure of potentially sensitive or system-critical files, exposing confidential data to anyone who can access the FTP service. The weakness aligns with CWE-22 and CWE-862, indicating improper access restrictions.

Progress Software WS_FTP Server running on Windows, all versions prior to 2025.0.5 are affected. Only the Thin Client Web Transfer HTTPS endpoint is involved, and the flaw is triggered by valid FTP authentication credentials.

The CVSS score of 7.7 reflects considerable impact while the EPSS score is not available, suggesting an uncertain but potentially significant exploitation likelihood. The vulnerability is not listed in CISA KEV, yet it requires authenticated access, which limits the attack surface to users with FTP credentials. Even so, the ability to read arbitrary files can lead to major confidentiality breaches, justifying immediate attention.