Read the docs
TI-2026-32348 Aliases CVE-2026-44403GHSA-ffh5-r5xj-cgmg

Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization

Priority MEDIUM 44CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02643 85th percentileScored 2026-11-07
Fix Fixed Wing FTP Server (Wing FTP Server): 8.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Wing FTP ServerWing FTP Server8.1.28.1.3Patch availableCNA
  • Wing FTP Server VendorWing FTP Server Affected 8.1.2 Fixed in 8.1.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*before 8.1.3VulnerableWing FTP Server
  • cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:* Versions before 8.1.3 Vulnerable ·Wing FTP Server

Remediation

  • Fix · CNA Wing FTP Server (Wing FTP Server) Fixed in 8.1.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44403
  2. 2026-10-03 Alias added: GHSA-ffh5-r5xj-cgmg

References

Other 1

  • TI-2025-30265 In Wing FTP Server before 7.4.4. KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-30266 Information disclosure through error messages in Wing FTP Server KEVCVSS 3.1MEDIUM 4.3
  • TI-2020-19167 Wing FTP Server 6.3.8 - Remote Code Execution CVSS 4.0HIGH 8.6
  • TI-2019-15321 Wing FTP Server 6.0.7 - Unquoted Service Path CVSS 4.0HIGH 8.5
  • TI-2025-20621 Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of… CVSS 3.1HIGH 8.8
  • TI-2025-04662 Wing FTP Server Lua Admin Console unnecessary privileges CVSS 4.0HIGH 7.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences