CVE-2026-105420

UNKNOWN 0.0

Path Traversal in Wing WFTP Server leading to Remote Code Execution

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.” This issue was fixed in version 8.2.6.

CWE	CWE-22
Vendor	wing soft technology
Product	wing ftp server
Published	Oct 28, 2026

Stay Ahead of the Next One

Get instant alerts for wing soft technology wing ftp server

Be the first to know when new unknown vulnerabilities affecting wing soft technology wing ftp server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Wing Soft Technology / Wing FTP Server

0 < 8.2.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/en/posts/2026/10/CVE-2026-105420 wftpserver.com: https://www.wftpserver.com/

Credits

Olek Malinowski