Threat reportVulnerabilityTL-2026-4703
Wing FTP Server Path Traversal (CWE-22) in User Base Folder Handling - CVE-2026-105420
Wing FTP Server Path Traversal (CWE-22) in User Base Folder (TL-2026-4703) is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-10-29. It has no confirmed attribution, affects Wing Soft Technology Wing FTP Server, references 1 CVE (CVE-2026-105420), maps to 4 MITRE ATT&CK techniques (T1059, T1078, T1190), and is covered by 9 detection rules and 11 indicators of compromise.
- CVSS
- 9.4/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4703
- Threat ID
- TL-2026-4703
- Severity
- CRITICAL
- CVSS
- 9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 11
How Wing FTP Server Path Traversal (CWE-22) in User Base Folder works
CERT Polska reports that Wing FTP Server before 8.2.6 does not verify the user base folder, so an administrator can add user directories via scripts that escape the base folder. This enables unauthorized file writes and potential remote code execution, with root privileges if the server was installed per the guide's sudo recommendation. Fixed in 8.2.6.
CVE-2026-105420 is a path traversal weakness (CWE-22, improper limitation of a pathname to a restricted directory) in Wing FTP Server by Wing Soft Technology. All versions before 8.2.6 are affected. The server does not properly verify a user's base folder setting: an attacker holding administrator privileges can add user directories via scripts, and the added directories are able to escape the configured base folder.
Because directories and files can be created outside the intended base folder, the flaw permits writing files to arbitrary locations on the host and, per the CVE record, potentially executing code with the privileges of the Wing FTP Server process owner. CERT Polska notes the severity is heightened because the installation guide recommends running installation commands with sudo, meaning files may be created with root-level privileges.
The vendor's version history for 8.2.6 (released 2026-10-09) lists the fix as: domain administrators could add user directories through scripts that could escape the base folder restriction. The same release also fixed a potential XSS in the older Admin UI (a separate item not attributed to this CVE). Wing FTP Server 8.2.7 was released 2026-10-28, the same day the CVE was published. The CVE was reserved 2026-10-05 and published 2026-10-28 with CERT Polska as the CNA following coordinated vulnerability disclosure; the finder credited is Olek Malinowski.
The CVE record carries a CVSS v4.0 base score of 9.4 (CRITICAL) with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; the high privilege requirement (PR:H) means exploitation needs administrator access, so the practical risk is escalation from a (domain) administrator or compromised admin account to host-level file write and possible code execution. The sources do not report in-the-wild exploitation, a public proof of concept, malware, infrastructure, or attribution; the NVD entry was in Deferred status at the time of research.
MITRE ATT&CK techniques used in TL-2026-4703
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Impact
Affected products and versions in Wing FTP Server Path Traversal (CWE-22) in User Base Folder
- Wing Soft Technology — Wing FTP Server
Vulnerable versions: all versions before 8.2.6
Fixed in: 8.2.6; 8.2.7
Remediation for Wing FTP Server Path Traversal (CWE-22) in User Base Folder
Patches
- Wing FTP Server 8.2.6 (released 2026-10-09) fixes the base folder escape
- Wing FTP Server 8.2.7 (released 2026-10-28) is the latest release
Immediate actions
- Upgrade Wing FTP Server to 8.2.6 or later (8.2.7 is the latest listed release)
- Audit Wing FTP Server administrator and domain administrator accounts and rotate their credentials
- Restrict network access to the Wing FTP administration interface to trusted management hosts
Workarounds
- Limit the number of administrator and domain administrator accounts until patched
- Avoid installing or running the service with sudo/root privileges
Longer-term hardening
- Run Wing FTP Server under a dedicated unprivileged account rather than root
- Monitor for file creation outside configured user base folders and for administrator-created user/script changes
CVEs associated with Wing FTP Server Path Traversal (CWE-22) in User Base Folder
Weaknesses (CWE) in Wing FTP Server Path Traversal (CWE-22) in User Base Folder
Timeline of Wing FTP Server Path Traversal (CWE-22) in User Base Folder
- Wing FTP Server 8.2.5 released; vendor notes a separate potential RCE fix in the web client (authenticated login with upload/download permissions required). Not attributed to CVE-2026-105420 but shows adjacent hardening in the same release train.
- CVE-2026-105420 reserved (CNA: CERT Polska) following a responsible-disclosure report by Olek Malinowski.
- Wing FTP Server 8.2.6 released; vendor notes fix for domain administrators being able to add user directories via scripts that escape the base folder.
- Wing FTP Server 8.2.7 released, listed by the vendor as the latest version.
- Vendor version history for 8.2.7 lists only stability, IP-rule wildcard, FTPS and self-signed certificate changes; the base folder fix remains attributed to 8.2.6.
- CVE record published with CVSS v4.0 base score 9.4 (CRITICAL); NVD entry created in Deferred status.
- CERT Polska publishes advisory for CVE-2026-105420 (all versions before 8.2.6 affected).
Sources cited for Wing FTP Server Path Traversal (CWE-22) in User Base Folder
Detection coverage for TL-2026-4703
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4703 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.