---
id: "CVE-2026-105420"
kind: "vulnerability"
aliases: ["CVE-2026-105420"]
title: "Wing FTP Server: user base folder check lets admins write files outside it"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ftp", "package", "self-hosted", "wing-ftp-server"]
not_affected_if: ["no-admin-exposure", "patched-8.2.6-or-later"]
published_at: "2026-10-28T14:16:56+00:00"
first_seen_at: "2026-10-28T14:33:22+00:00"
updated_at: "2026-10-28T14:34:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105420", "first_seen_at": "2026-10-28T14:33:22+00:00"}]
---

# Wing FTP Server: user base folder check lets admins write files outside it

Wing FTP Server does not verify that a user's base folder stays inside its allowed path. An attacker with admin rights can add user directories through scripts that escape the base folder, write arbitrary files, and reach remote code execution with the server's privileges, which can be root if the server was started with sudo.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Wing FTP Server version against `8.2.6`
- Review user home or base folder settings for paths outside the intended root
- unknown

## Fix

- Upgrade Wing FTP Server to `8.2.6` or later
- Review admin accounts and rotate their credentials
- Check for unexpected files created outside user base folders, especially root-owned ones

## Timeline

- 2026-10-28T14:33:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105420

## From the sources

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.”




This issue was fixed in version 8.2.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_