Executive brief
Wing FTP Server is a professional file transfer solution used by organizations to manage and share data. A security vulnerability in versions prior to 8.1.3 allows an authenticated administrator to execute malicious code on the server. This could lead to a complete takeover of the server, unauthorized access to sensitive files, and disruption of file transfer services.
Technical details
Wing FTP Server before version 8.1.3 is vulnerable to remote code execution (RCE) due to improper input validation in its session serialization mechanism. An authenticated administrator can inject arbitrary Lua code through the 'mydirectory' field within the domain admin settings. The vulnerability stems from unsafe serialization of session values into Lua source code without proper escaping of closing delimiters. When the poisoned session is subsequently loaded via the loadfile() function, the injected Lua code is executed with the privileges of the server process. This issue was addressed in version 8.1.3.
Affected products
- Wing FTP Server Wing FTP Server < 8.1.3
Timeline
- 2026-03-18: patched: Fixed in version 8.1.3
- 2026-05-12: disclosed: Initial NVD publication