---
id: CVE-2026-105420
title: Path Traversal in Wing WFTP Server leading to Remote Code Execution
summary: >-
  Wing FTP Server does not verify user's base folder. An attacker with admin
  privileges can add user directories via scripts, allowing the added
  directories to escape the base folder. This allows the attacker to write files
  on the system a…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: Wing Soft Technology
product: Wing FTP Server
affected:
  - wing_ftp_server < 8.2.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-05T18:30:39.344679Z'
published: '2026-10-28'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T18:32:29.623Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105420'
references:
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2026-105420'
  - url: 'https://www.wftpserver.com/'
tags:
  - cve.org
epss: 0.00518
epssPercentile: 0.44213
ingestedAt: '2026-10-28T14:12:18.563Z'
---

## Overview

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.”




This issue was fixed in version 8.2.6.

## Affected

- `wing_ftp_server < 8.2.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.