Vulnerability Intelligence Report
Path Traversal in Wing WFTP Server leading to Remote Code Execution
CVE-2026-105420
Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.” This issue was fixed in version 8.2.6.
Path Traversal
No Active Exploit Signals
CVSS Base Score
9.4
CRITICAL
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-22 ↗CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Wing Soft Technology | Wing FTP Server | 0 < 8.2.6 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Vulnerability Class
Path Traversal
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | CERT.PL · CERT · Poland |
| Reserved | 2026-10-05T11:39:15 |
| Published | 2026-10-28T13:19:31 |
| Last Updated | 2026-10-28T13:19:31 |
Community Chatter & Buzz