wing_ftp_server vulnerabilities
CVEs whose affected-version data names the wing_ftp_server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-120491Medium· 5.4Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page
Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of …
▾ SunlitWing FTP Software · Wing FTP ServerEPSS 0.18%via CVEORG
CVE-2026-105420Critical· 9.4Path Traversal in Wing WFTP Server leading to Remote Code Execution
Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system a…
▾ MidnightWing Soft Technology · Wing FTP ServerEPSS 0.52%via CVEORG