Description

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.” This issue was fixed in version 8.2.6.

Related CPE's

Could not find any relations

References

https://cert.pl/en/posts/2026/10/CVE-2026-105420

https://www.wftpserver.com/

Weaknesses

[email protected]

Primary
CWE-22

CVSS impact metrics

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

9.4 · Critical

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-28T14:16:56.230Z

2 hours ago

Last modified

2026-10-28T15:24:56.033Z

57 minutes ago