CVE-2026-120491: XSS
Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admingetlastconn.html XML to forge a connection id, which executes in administrators' browsers when adminconnectionlist.html auto-refreshes, enabling Lua console abuse.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wing FTP Serverto a version that resolves this vulnerability.Fixed in 8.2.6
Event History
Frequently Asked Questions
Which deployments are affected?
Wing FTP Server versions before 8.2.6 are affected. The issue involves the web client and administrator activity/connection-list pages.
What access does an attacker need to trigger the issue?
The attacker needs an authenticated web-client account and must be able to send a crafted nowpath parameter to webclient/makethumb.html. Exploitation also relies on an administrator viewing the auto-refreshing admin_connection_list.html page.
What can happen if an administrator views the injected content?
The injected script executes in the administrator's browser. The described result is abuse of the Lua console after a forged connection ID is presented through the administrator activity data.