CVE-2026-105420 Details
Description
Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.” This issue was fixed in version 8.2.6.
A path traversal vulnerability has been identified in Wing FTP Server, affecting all versions prior to 8.2.6. The issue arises because the server does not properly validate users' base folders. An attacker with admin privileges can exploit this flaw by adding user directories through scripts, potentially allowing these directories to escape the designated base folder. This exploitation enables the attacker to write files on the system, which could lead to remote code execution with the privileges of the process owner. Notably, files created in this manner are attributed to the 'root' user, as the installation guide recommends using 'sudo' when executing the relevant commands.
Users are advised to upgrade to Wing FTP Server version 8.2.6 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert.pl/en/posts/2026/10/CVE-2026-105420 | [email protected] | AdvisoryRemedy |
| https://www.wftpserver.com/ | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wing FTP Server | < 8.2.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |