Vulnerability details
CVE-2026-105420
Wing Soft Technology Wing FTP Server
Path Traversal in Wing WFTP Server leading to Remote Code Execution
CVSS 4.0
9.4Critical
Official description
Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.” This issue was fixed in version 8.2.6.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (CERT-PL) | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Wing Soft Technology | Wing FTP Server | v < 8.2.6 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://cert.pl/en/posts/2026/10/CVE-2026-105420 third-party-advisory
- https://www.wftpserver.com/ product
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-28
- Last updated
- 2026-11-05
- State
- Published
- Assigner (CNA)
- CERT-PL
- Kolun priority
- 25 · Low
Exploit prediction (EPSS)
0.51%
Probability of exploitation in 30 days
44.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')