Vulnerability · Published Oct 28, 2026 · Assigned by CERT-PL

CVE-2026-105420Path Traversal in Wing WFTP Server leading to Remote Code Execution

Critical 9.4

In plain English

A critical-severity path traversal in Wing FTP Server from Wing Soft Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.5%top 55.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.” This issue was fixed in version 8.2.6.

Affected products (as reported)

Vendor	Product	Versions
Wing Soft Technology	Wing FTP Server	0 – before 8.2.6

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://cert.pl/en/posts/2026/10/CVE-2026-105420 third-party-advisory
https://www.wftpserver.com/ product