{"id":"CVE-2026-44403","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-44403","generatedAt":"2026-10-28T03:27:31.176Z","title":"Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field.","description":"Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().","published":"2026-05-12T21:16:17.000Z","lastModified":"2026-06-17T10:50:36.000Z","status":"Analyzed","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.6,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-94"],"affected":["wftpserver/wing ftp server"],"epss":{"score":0.02643,"percentile":0.85484,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2026-05-29","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":52589,"kind":"exploit","title":"Wing FTP Server 8.1.3 - Authenticated Remote Code Execution","url":"https://www.exploit-db.com/exploits/52589","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/52589.txt","file":"exploits/multiple/remote/52589.txt","published":"2026-05-29","added":"2026-05-29","updated":"2026-05-29","author":"Ünsal Furkan Harani","type":"remote","platform":"multiple","port":null,"verified":false,"codes":["CVE-2026-44403"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"A public exploit is published in Exploit-DB and the impact is high, while EPSS rates exploitation at 2.6%. Anyone can run this; patch or mitigate before the next change window and check exposed instances for signs of use."},"changes":[],"references":[{"url":"https://www.vulncheck.com/advisories/wing-ftp-server-authenticated-remote-code-execution-via-session-serialization","tags":["Third Party Advisory"],"source":"disclosure@vulncheck.com"},{"url":"https://www.wftpserver.com/serverhistory.htm","tags":["Product","Release Notes"],"source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-44403","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}