VulnerabilityDeferred

CVE-2026-105420

An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder.

CRITICAL 9.4EPSS 0.52%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.” This issue was fixed in version 8.2.6.

CVSS 4.0: 9.4 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.52% probability · 44th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-22
Source: cvd@cert.pl

EPSS trend

EPSS moved from 0.5% on 29 October 2026 to 0.5% on 3 November 2026.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.