# Wing FTP Server Path Traversal (CWE-22) in User Base Folder Handling - CVE-2026-105420

> CERT Polska reports that Wing FTP Server before 8.2.6 does not verify the user base folder, so an administrator can add user directories via scripts that escape the base folder. This enables unauthorized file writes and potential remote code execution, with root privileges if the server was installed per the guide's sudo recommendation. Fixed in 8.2.6.

- **Published:** 2026-10-29T04:54:49Z
- **Last reviewed:** 2026-10-29T04:54:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4703
- **ID:** TL-2026-4703
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-105420

## Description

CVE-2026-105420 is a path traversal weakness (CWE-22, improper limitation of a pathname to a restricted directory) in Wing FTP Server by Wing Soft Technology. All versions before 8.2.6 are affected. The server does not properly verify a user's base folder setting: an attacker holding administrator privileges can add user directories via scripts, and the added directories are able to escape the configured base folder.

Because directories and files can be created outside the intended base folder, the flaw permits writing files to arbitrary locations on the host and, per the CVE record, potentially executing code with the privileges of the Wing FTP Server process owner. CERT Polska notes the severity is heightened because the installation guide recommends running installation commands with sudo, meaning files may be created with root-level privileges.

The vendor's version history for 8.2.6 (released 2026-10-09) lists the fix as: domain administrators could add user directories through scripts that could escape the base folder restriction. The same release also fixed a potential XSS in the older Admin UI (a separate item not attributed to this CVE). Wing FTP Server 8.2.7 was released 2026-10-28, the same day the CVE was published. The CVE was reserved 2026-10-05 and published 2026-10-28 with CERT Polska as the CNA following coordinated vulnerability disclosure; the finder credited is Olek Malinowski.

The CVE record carries a CVSS v4.0 base score of 9.4 (CRITICAL) with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; the high privilege requirement (PR:H) means exploitation needs administrator access, so the practical risk is escalation from a (domain) administrator or compromised admin account to host-level file write and possible code execution. The sources do not report in-the-wild exploitation, a public proof of concept, malware, infrastructure, or attribution; the NVD entry was in Deferred status at the time of research.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1565.001 Stored Data Manipulation

## Sources

- [Vulnerability in Wing FTP Server software (CERT Polska)](https://cert.pl/en/posts/2026/10/CVE-2026-105420/)
- [CVE-2026-105420 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-105420)
- [NVD - CVE-2026-105420](https://nvd.nist.gov/vuln/detail/CVE-2026-105420)
- [Wing FTP Server Version History (8.2.6 release notes)](https://www.wftpserver.com/serverhistory.htm)
- [Wing FTP Server product page](https://www.wftpserver.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4703