Authenticated Remote Code Execution in Wing FTP Server by Wing FTP
CVE-2026-44403

8.6HIGH

Key Information:

Vendor

Wing Ftp Server

Status
Wing Ftp Server
Vendor
CVE Published:
12 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-44403?

Wing FTP Server version 8.1.2 is impacted by a remote code execution vulnerability resulting from unsafe session serialization. Authenticated administrators can exploit this flaw by injecting arbitrary Lua code through the domain admin mydirectory field. The vulnerability arises because the session values are serialized into Lua source code without adequate escaping of closing delimiters, enabling attackers to execute the injected code whenever the altered session is loaded via the loadfile() function. This serious risk could lead to unauthorized access and compromise of server integrity.

Affected Version(s)

Wing FTP Server 8.1.2

Wing FTP Server 8.1.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-44403-WingFTP-v8.1.2-POC-Exploit
Created by ZemarKhos

References

https://www.vulncheck.com/advisories/wing-ftp-server-auth...
vendor-advisory
https://www.wftpserver.com/serverhistory.htm
release-notes

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ünsal Furkan Harani
.