An OS command injection flaw in Progress Software WS_FTP Server permits arbitrary command execution on the underlying Windows operating system when the server processes certain untrusted input fields. The vulnerability enables an attacker to craft input that is passed to a system utility without proper sanitization, allowing the attacker to execute arbitrary shell commands. The specific attack vector is not explicitly detailed in the advisory, but it can be inferred that the injection is triggered by FTP control commands or configuration data that is interpreted as part of an operating‑system command line. This flaw grants the attacker complete control over the affected host, potentially leading to data theft, ransomware deployment, or further lateral movement.

Vendors include Progress Software, product WS_FTP Server. All releases before 2024.0.7 and 2025.0.4 are vulnerable when running on Windows. No other versions or operating systems are listed in the advisory, and no additional affected products were identified.

The CVSS v3.1 score of 9.9 classifies the vulnerability as Critical, emphasizing the potential for widespread compromise. The EPSS score is not reported, but the lack of KEV listing does not diminish the risk; the flaw is fully exploitable in remote scenarios. An attacker only needs to send specially crafted FTP requests, and no additional authentication or privilege escalation is required. The likely attack path is simple: connect to the FTP service, send the malicious payload, and execute arbitrary commands on the host.