{"id":"CVE-2026-120491","kind":"vulnerability","aliases":["CVE-2026-120491"],"related":[],"title":"Wing FTP Server: stored script injection lets users run code in admin browsers","description":"Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, enabling Lua console abuse.","summary":"Wing FTP Server before 8.2.6 lets an authenticated web-client user store a crafted nowpath parameter that breaks out of an XML CDATA section and forges a connection id. The script runs in an administrator's browser when the connection list auto-refreshes, which the description says enables Lua console abuse.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ftp","runtime","self-hosted","wing-ftp-server"],"not_affected_if":["version-8.2.6-or-later","web-client-disabled"],"how_to_check":"- Check the installed Wing FTP Server version; the sources say versions before `8.2.6` are affected.\n- Confirm whether the web client is exposed to users who can log in.","fix":"- Move to `8.2.6` or later, per the sources.","status":"open","published_at":"2026-11-02T15:17:31+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","triaged_at":"2026-11-02T15:26:21+00:00","updated_at":"2026-11-02T15:26:21+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-02T15:26:21Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `8.2.6` or later, per the sources.","reach":"network","title":"Wing FTP Server: stored script injection lets users run code in admin browsers","impact":"high","summary":"Wing FTP Server before 8.2.6 lets an authenticated web-client user store a crafted nowpath parameter that breaks out of an XML CDATA section and forges a connection id. The script runs in an administrator's browser when the connection list auto-refreshes, which the description says enables Lua console abuse.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wing-ftp-server","self-hosted","ftp"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Admin browser runs injected script, enabling Lua console abuse on server","analyst_note":"Confirm default web-client exposure and whether the Lua console abuse is reachable in default config; check the VulnCheck advisory linked in the sources.","how_to_check":"- Check the installed Wing FTP Server version; the sources say versions before `8.2.6` are affected.\n- Confirm whether the web client is exposed to users who can log in.","plain_action":"","needs_analyst":true,"not_affected_if":["version-8.2.6-or-later","web-client-disabled"],"who_is_affected":"Sites running Wing FTP Server before 8.2.6 with the web client enabled and accounts that can log in to it. The sources describe an authenticated attacker and an administrator viewing the admin connection list, so servers with no web-client users are less exposed. Whether a default configuration is affected is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4202,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120491':16A,19A '-2026':15A,18A '8.2.6':33B,86C 'abus':81B,143C 'admin':12A 'admin_connection_list.html':136C 'admin_get_lastconn.html':123C 'administr':64B,133C 'allow':96C 'attack':113C 'authent':36B,97C 'auto':72B,138C 'auto-refresh':71B,137C 'break':47B,115C 'browser':13A,66B,134C 'cdata':52B,120C 'client':39B,100C 'code':10A 'connect':57B,69B,128C 'consol':80B,142C 'contain':87C 'craft':43B,108C 'cross':91C 'cross-sit':90C 'cve':14A,17A 'descript':76B 'directori':119C 'enabl':78B,140C 'execut':131C 'forg':55B,126C 'ftp':2A,20B,27B,30B,83C 'host':24B 'id':58B,129C 'inject':6A,103C 'let':7A,34B 'list':70B 'lua':79B,141C 'nowpath':44B,109C 'paramet':45B,110C 'refresh':73B,139C 'run':9A,61B 'runtim':21B 'say':77B 'script':5A,60B,93C,104C 'section':53B,121C 'self':23B 'self-host':22B 'send':106C 'server':3A,28B,31B,84C 'site':92C 'store':4A,41B,89C 'user':8A,40B,101C 'vulner':94C 'web':38B,99C 'web-client':37B,98C 'webclient/makethumb.html':112C 'wing':1A,26B,29B,82C 'wing-ftp-serv':25B 'xml':51B,124C","nicknames":[],"mitigations":[],"who_affected":"Sites running Wing FTP Server before 8.2.6 with the web client enabled and accounts that can log in to it. The sources describe an authenticated attacker and an administrator viewing the admin connection list, so servers with no web-client users are less exposed. Whether a default configuration is affected is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ftp","medium","runtime","selfhosted","wingftpserver"],"first_public_at":"2026-11-02T15:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120491","severity":null,"published_at":"2026-11-02T15:17:31+00:00","modified_at":"2026-11-02T15:17:31+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","fetched_at":"2026-11-02T15:24:04+00:00","note":null}],"documents":[{"id":52535,"url":"https://www.vulncheck.com/advisories/wing-ftp-server-before-8.2.6-stored-xss-via-nowpath-in-legacy-activity-page","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}