PT-2026-40434 · Unknown · Wing Ftp Server

Published 2026-05-12 · Updated 2026-05-30 · CVE-2026-44403

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wing FTP Server version 8.1.2

Description An authenticated remote code execution issue exists in the session serialization mechanism. Authenticated administrators can inject arbitrary Lua code through the domain admin mydirectory field. This occurs because session values are unsafely serialized into Lua source code without proper escaping of closing delimiters, leading to the execution of injected code when the poisoned session is loaded via the loadfile() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-44403

Affected Products

Wing Ftp Server

References · 7

• 🔥 https://exploit-db.com/exploits/52589 · Exploit
• https://vulncheck.com/advisories/wing-ftp-server-authenticated-remote-code-execution-via-session-serialization · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44403 · Security Note
• https://t.me/cveNotify/163307 · Telegram Post
• https://reddit.com/r/cybersecurity/comments/1trvw2f/panos_added_to_kev_langflow_exploit_activity_and · Reddit Post
• https://twitter.com/CVEnew/status/2054324009131798712 · Twitter Post
• https://wftpserver.com/serverhistory.htm · Note