CVE-2019-25267: Wing FTP Server 6.0.7 - Unquoted Service Path
Published Feb 4, 2026
·Updated
Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables that will be launched with LocalSystem permissions.
Affected Software
2 affected components
Wing FTP Wing FTP Server
Wftpserver Wing Ftp Server=6.0.7
Event History
Feb 4, 2026
CVE Published
via MITRE·11:15 PM
Data Sourced
via MITRE·11:15 PM
DescriptionSeverityWeakness
Feb 5, 2026
Data Sourced
via NVD·12:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-25267?
CVE-2019-25267 has a high severity rating due to its potential for local code execution with elevated privileges.
2
How do I fix CVE-2019-25267?
To fix CVE-2019-25267, update Wing FTP Server to the latest version that has addressed this vulnerability.
3
What type of vulnerability is CVE-2019-25267?
CVE-2019-25267 is an unquoted service path vulnerability.
4
Who is affected by CVE-2019-25267?
CVE-2019-25267 affects users of Wing FTP Server version 6.0.7.
5
Can CVE-2019-25267 be exploited remotely?
CVE-2019-25267 requires local access for attackers to exploit the vulnerability.