CVE-2026-44403
HighSummary
Wing FTP Server before version 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism. This allows authenticated administrators to inject arbitrary Lua code through the mydirectory field in the admin panel.
Risk Assessment
Attackers can exploit this vulnerability to execute malicious code on the server, potentially leading to severe security breaches and data loss. Organizations should be aware of the risks associated with unauthorized access to the system.
Recommendation
It is recommended to update Wing FTP Server to version 8.1.3 or later to mitigate this vulnerability. Additionally, monitoring and auditing access to the admin panel should be implemented to detect potential attack attempts.
Other vulnerabilities in Wing FTP Server
See all- CVE-2026-105420Critical
Wing FTP Server does not verify the user's base folder, allowing an attacker with admin privileges to add user directories via scripts that escape the base folder. This enables file writes on the system and potential remote code execution with process owner privileges, and with sudo-based installation files are created as root. Fixed in version 8.2.6.
- CVE-2025-47813MediumActively exploited
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
- CVE-2025-47812CriticalActively exploited
In Wing FTP Server before 7.4.4, the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
Original NVD description (English source)
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().
Vulnerability data from NVD (NIST) · CISA KEV · EPSS