Wing FTP Server path traversal flaw fixed
A path traversal bug in Wing FTP Server lets admins escape user base folders to write files and gain root-level RCE; patched in 8.2.6.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-105420, a path traversal vulnerability (CWE-22) affecting all versions of Wing FTP Server prior to 8.2.6. The flaw stems from improper validation of a user's base folder: an attacker with admin privileges can add user directories via scripts that escape the intended base folder restriction, allowing arbitrary file writes on the host system.
The impact is heightened because Wing FTP Server's installation guide instructs administrators to run the service with sudo, meaning files written through this traversal are created with root ownership. This can lead to remote code execution with the privileges of the process owner — potentially root, depending on deployment. The vulnerability requires existing admin-level access to exploit, limiting it to privilege escalation or lateral abuse scenarios rather than unauthenticated external compromise.
The vendor, Wing Soft Technology, fixed the issue in version 8.2.6. There is no indication in this report of active in-the-wild exploitation; this is a coordinated disclosure following a report to CERT Polska by researcher Olek Malinowski. Defenders running Wing FTP Server should upgrade to 8.2.6 or later immediately, audit admin account access, and review installations for non-root service execution where feasible to limit blast radius from any future exploitation.
Mentioned in this report
Detection guidance
Wing FTP Server Daemon Spawning Shell on Linux
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the Wing FTP Server daemon spawning a shell, a likely post-exploitation step after files are written outside the base folder (CVE-2026-105420) and executed with the service's privileges. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Wing FTP Server Daemon Spawning Shell on Linux
description: Detects the Wing FTP Server daemon (wftpserver) spawning an interactive
or command shell. Relevant to abuse of the path traversal flaw CVE-2026-105420,
where an admin writes arbitrary files that lead to code execution as the service
owner, often root because the install guide uses sudo.
tags:
- attack.execution
- attack.privilege-escalation
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith: /wftpserver
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
- /ksh
condition: selection
falsepositives:
- Legitimate Wing FTP event or Lua scripts that call os.execute and run a shell command
- Administrator-configured post-upload hooks that invoke shell scripts
level: medium
id: 42336f4c-aff1-548b-9d6a-fce188e6b38b
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-105420
Wing FTP Server Service Spawning Command Interpreter on Windows
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the Wing FTP Server process spawning cmd.exe or PowerShell, which may indicate code execution after abuse of admin scripting or the user base folder path traversal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Wing FTP Server Service Spawning Command Interpreter on Windows
description: Detects the Wing FTP Server process spawning cmd.exe, PowerShell or pwsh.
May indicate code execution following abuse of admin-level scripting or the user
base folder path traversal (CVE-2026-105420).
tags:
- attack.execution
- attack.t1059.003
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \wftpserver.exe
- \Wing FTP Server.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
condition: selection
falsepositives:
- Legitimate Wing FTP event handlers or Lua scripts that run batch files via os.execute
- Administrator-configured post-transfer processing scripts
level: medium
id: c3d8522e-a5d8-5675-bfc6-4b7e8b8204df
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-105420
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-105420
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs