Vulnerability · Published May 12, 2026 · Assigned by VulnCheck

CVE-2026-44403Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization

High 7.2

In plain English

A high-severity code injection in Wing FTP Server from Wing FTP Server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)2.6%top 14.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().

Affected products (as reported)

Vendor	Product	Versions
Wing FTP Server	Wing FTP Server	8.1.2

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://www.vulncheck.com/advisories/wing-ftp-server-authenticated-remote-code-execution-via-session-serialization vendor-advisory
https://www.wftpserver.com/serverhistory.htm release-notes