Live › vulnerability › CVE-2026-120491
Wing FTP Server before 8.2.6 lets an authenticated web-client user store a crafted nowpath parameter that breaks out of an XML CDATA section and forges a connection id. The script runs in an administrator's browser when the connection list auto-refreshes, which the description says enables Lua console abuse.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Sites running Wing FTP Server before 8.2.6 with the web client enabled and accounts that can log in to it. The sources describe an authenticated attacker and an administrator viewing the admin connection list, so servers with no web-client users are less exposed. Whether a default configuration is affected is unknown.
No product ranges from the sources yet.
8.2.6 are affected.8.2.6 or later, per the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, enabling Lua console abuse.
This page as .md · .json · in your agent: get_signal("CVE-2026-120491")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.