Authenticated Remote Code Execution in Wing FTP Server by Wing FTP

CVE-2026-44403

What is CVE-2026-44403?

Wing FTP Server version 8.1.2 is impacted by a remote code execution vulnerability resulting from unsafe session serialization. Authenticated administrators can exploit this flaw by injecting arbitrary Lua code through the domain admin mydirectory field. The vulnerability arises because the session values are serialized into Lua source code without adequate escaping of closing delimiters, enabling attackers to execute the injected code whenever the altered session is loaded via the loadfile() function. This serious risk could lead to unauthorized access and compromise of server integrity.

References