CVE-2026-105420: Path Traversal in Wing WFTP Server leading to Remote Code Execution

Q: Who can exploit this issue?

An attacker needs administrative privileges in Wing FTP Server and the ability to add user directories through scripts. The issue is therefore most relevant where administrative access has been compromised or delegated to untrusted users.

Q: What privileges could successful exploitation provide?

The attacker can write files outside the intended base folder, which can lead to remote code execution with the privileges of the Wing FTP Server process owner. If the server was installed or run using sudo as described in the installation guide, created files may be owned by root.

Q: Which versions are affected and what is the fix?

The issue was fixed in Wing FTP Server version 8.2.6. Upgrade to version 8.2.6 or later.

Published Oct 28, 2026

Updated

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with sudo, the files are created as “root.”

This issue was fixed in version 8.2.6.

Affected Software

1 affected component

Wing Wing FTP Server<8.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Wing FTP Server to a version that resolves this vulnerability.
Fixed in 8.2.6

Event History

Oct 28, 2026

CVE Published

via MITRE·01:19 PM

Data Sourced

via MITRE·01:19 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs administrative privileges in Wing FTP Server and the ability to add user directories through scripts. The issue is therefore most relevant where administrative access has been compromised or delegated to untrusted users.

What privileges could successful exploitation provide?

The attacker can write files outside the intended base folder, which can lead to remote code execution with the privileges of the Wing FTP Server process owner. If the server was installed or run using sudo as described in the installation guide, created files may be owned by root.

Which versions are affected and what is the fix?

The issue was fixed in Wing FTP Server version 8.2.6. Upgrade to version 8.2.6 or later.

CVE-2026-105420: Path Traversal in Wing WFTP Server leading to Remote Code Execution

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What privileges could successful exploitation provide?

Which versions are affected and what is the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What privileges could successful exploitation provide?

Which versions are affected and what is the fix?