9.4
CriticalCVSS 4.0 · from CERT-PL
CVE-2026-105420
Path Traversal in Wing WFTP Server leading to Remote Code Execution
Wing FTP Server · Path traversal · CWE-22AffectedWing FTP Server
FixUpdate to 8.2.6 or newer
PublishedOct 28, 13:19 · CERT-PL
ScoredOct 28 · 9.4 · CERT-PL
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.” This issue was fixed in version 8.2.6.
From CERT-PL
Affected and fixed versions
ProductAffectedFixed inWing FTP Serverbefore 8.2.68.2.6
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known