CVE-2026-44403: Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44403?
CVE-2026-44403 is rated as critical due to its potential for authenticated remote code execution.
How do I fix CVE-2026-44403?
To fix CVE-2026-44403, upgrade Wing FTP Server to the latest version available.
Who is affected by CVE-2026-44403?
CVE-2026-44403 affects all authenticated administrators using Wing FTP Server version 8.1.2.
What type of vulnerability is CVE-2026-44403?
CVE-2026-44403 is an authenticated remote code execution vulnerability related to session serialization.
What can attackers do with CVE-2026-44403?
Attackers can exploit CVE-2026-44403 to inject arbitrary Lua code on the affected Wing FTP Server.