# Wing FTP Server path traversal flaw fixed

Published: 2026-10-28 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/35cc200a-8f64-5025-ba9e-1ebb0b6c5fcf/wing-ftp-server-path-traversal-flaw-fixed
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> A path traversal bug in Wing FTP Server lets admins escape user base folders to write files and gain root-level RCE; patched in 8.2.6.

Source: cert.pl — https://cert.pl/en/posts/2026/10/CVE-2026-105420

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT Polska coordinated disclosure of CVE-2026-105420, a path traversal vulnerability (CWE-22) affecting all versions of Wing FTP Server prior to 8.2.6. The flaw stems from improper validation of a user's base folder: an attacker with admin privileges can add user directories via scripts that escape the intended base folder restriction, allowing arbitrary file writes on the host system.

The impact is heightened because Wing FTP Server's installation guide instructs administrators to run the service with sudo, meaning files written through this traversal are created with root ownership. This can lead to remote code execution with the privileges of the process owner — potentially root, depending on deployment. The vulnerability requires existing admin-level access to exploit, limiting it to privilege escalation or lateral abuse scenarios rather than unauthenticated external compromise.

The vendor, Wing Soft Technology, fixed the issue in version 8.2.6. There is no indication in this report of active in-the-wild exploitation; this is a coordinated disclosure following a report to CERT Polska by researcher Olek Malinowski. Defenders running Wing FTP Server should upgrade to 8.2.6 or later immediately, audit admin account access, and review installations for non-root service execution where feasible to limit blast radius from any future exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-105420

## Detection guidance (public sample)

### Wing FTP Server Daemon Spawning Shell on Linux

ATT&CK: T1059.004

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects the Wing FTP Server daemon spawning a shell, a likely post-exploitation step after files are written outside the base folder (CVE-2026-105420) and executed with the service's privileges. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Wing FTP Server Daemon Spawning Shell on Linux
description: Detects the Wing FTP Server daemon (wftpserver) spawning an interactive
  or command shell. Relevant to abuse of the path traversal flaw CVE-2026-105420,
  where an admin writes arbitrary files that lead to code execution as the service
  owner, often root because the install guide uses sudo.
tags:
- attack.execution
- attack.privilege-escalation
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /wftpserver
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /zsh
    - /ksh
  condition: selection
falsepositives:
- Legitimate Wing FTP event or Lua scripts that call os.execute and run a shell command
- Administrator-configured post-upload hooks that invoke shell scripts
level: medium
id: 42336f4c-aff1-548b-9d6a-fce188e6b38b
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-105420
```

### Wing FTP Server Service Spawning Command Interpreter on Windows

ATT&CK: T1059.003

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects the Wing FTP Server process spawning cmd.exe or PowerShell, which may indicate code execution after abuse of admin scripting or the user base folder path traversal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Wing FTP Server Service Spawning Command Interpreter on Windows
description: Detects the Wing FTP Server process spawning cmd.exe, PowerShell or pwsh.
  May indicate code execution following abuse of admin-level scripting or the user
  base folder path traversal (CVE-2026-105420).
tags:
- attack.execution
- attack.t1059.003
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \wftpserver.exe
    - \Wing FTP Server.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  condition: selection
falsepositives:
- Legitimate Wing FTP event handlers or Lua scripts that run batch files via os.execute
- Administrator-configured post-transfer processing scripts
level: medium
id: c3d8522e-a5d8-5675-bfc6-4b7e8b8204df
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-105420
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-105420

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/35cc200a-8f64-5025-ba9e-1ebb0b6c5fcf/wing-ftp-server-path-traversal-flaw-fixed.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup