Wing FTP Server: Path traversal leading to remote code execution
Summary
Wing FTP Server does not properly verify the base folder of users. An attacker with administrative privileges can use scripts to add user directories that escape the base folder, write files to the system, and potentially execute code with the privileges of the server process. Because the installation guide suggests running the installer with sudo, files may be created as root. The CVSS 9.4 score assumes an attacker who already holds admin rights.
Affected
- Wing FTP Server versions before 8.2.6 (CERT Polska).
- VulDB lists the range as up to 8.2.5.
Fixed in
- Upgrade to Wing FTP Server 8.2.6 or later. The vendor released 8.2.6 on 9 October 2026.
Workaround
Unknown. No vendor workaround found.
- Restrict admin and domain admin rights to the necessary accounts.
- Run the service as a normal user, not as root or SYSTEM, as general hardening.
Exploitation
- Not known to be exploited in the wild (OffSeq).
- VulDB states that no exploit is available. A Metasploit or nuclei entry could not be confirmed.
Our recommendation
- Identify all Wing FTP Server instances and their versions.
- Upgrade every instance below 8.2.6 to 8.2.6 or later.
- Review admin and domain admin accounts and rotate their passwords.
- Check whether the service runs as root and change it if needed.
- Review logs for unexpected directories or files created under user accounts.
- Confirm that admin interfaces are not reachable from the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska: Vulnerability in Wing FTP Server software cert.pl
- Wing FTP Server vendor website www.wftpserver.com
- Wing FTP Server version history www.wftpserver.com
- VulDB entry for CVE-2026-105420 vuldb.com
- OffSeq Radar threat entry for CVE-2026-105420 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:42.
Original description (NVD)
Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.” This issue was fixed in version 8.2.6.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.