Improper limiting of pathnames in WS_FTP Server prior to versions 2024.0.7 and 2025.0.4 on Windows allows an unauthenticated attacker to delete files outside the intended directory through path traversal. This vulnerability can cause loss of critical files, disrupt services, and compromise the integrity of the server’s data. It is categorized as CWE-22 and CWE-73.

The issue affects Progress Software’s WS_FTP Server running on Windows. Versions before 2024.0.7 and before 2025.0.4 are impacted. No specific sub‑versions are listed, so all builds in those release lines are potentially vulnerable.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, so exploitation is not currently documented. The likely attack path requires unauthenticated interaction with the Ad Hoc Transfer or Web Transfer interfaces, which are commonly enabled on public FTP deployments. Because the directory limits are not properly enforced, an attacker may delete arbitrary files if the target system permits use of these transfer modes.