CVE-2026-44403 - Vulnerability Analysis

Overview

Wing FTP Server 8.1.2 contains an authenticated remote code execution caused by unsafe serialization of session values into Lua source code in the domain admin mydirectory field, letting authenticated administrators execute arbitrary Lua code remotely, exploit requires authenticated administrator privileges.

Severity & Score

Impact

Authenticated administrators can execute arbitrary Lua code remotely, potentially leading to full server compromise.

Mitigation

Update to the latest version of Wing FTP Server.

References

• https://www.wftpserver.com/serverhistory.htm
• https://www.vulncheck.com/advisories/wing-ftp-server-authenticated-remote-code-execution-via-session-serialization

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner