Unauthorized File Manipulation in Wing FTP Server by Vendor Wing FTP Server
CVE-2026-105420

9.4CRITICAL

Key Information:

Vendor

Wing Soft Technology

Status
Wing Ftp Server
Vendor
CVE Published:
28 October 2026

What is CVE-2026-105420?

Wing FTP Server has a vulnerability that allows an attacker with admin privileges to add user directories using scripts without verifying the user's base folder. This oversight permits the added directories to escape the intended base folder, leading to potential unauthorized access and manipulation of system files. Most critically, if the server command is executed with elevated privileges using 'sudo', any files created can be owned by the root user. Consequently, this flaw may enable remote code execution at elevated privileges on the server.

Affected Version(s)

Wing FTP Server 0 < 8.2.6

References

https://cert.pl/en/posts/2026/10/CVE-2026-105420
third-party-advisory
https://www.wftpserver.com/
product

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Olek Malinowski
.