CVE-2026-105420

Vendor

Wing Soft Technology

Product

Wing FTP Server

CVSS v4.0

9.4 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

0.005 (p44)

Weakness

CWE-22

Exposure class

Operating system, File transfer

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 43
   CVE NVD 3d ago

   Wing FTP Server does not verify user's base folder.

   Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the…

   CVSS 9.4 Fix available CVE-2026-105420 Wing Soft Technology
2. 29
   Advisory CERT Polska 3d ago

   Vulnerability in Wing FTP Server software

   Path Traversal vulnerability (CVE-2026-105420) has been found in Wing FTP Server software.

   CVE-2026-105420