Wing FTP Server CVE-2026-105420

Requires an authenticated administrator account on Wing FTP Server (CVSS PR:H): the attacker leverages the admin capability to add user directories via scripting, and the server fails to verify that a user's base folder stays within bounds, so a crafted directory path escapes the base folder and permits arbitrary file write. Full root-level RCE is contingent on the service running with elevated privileges - specifically the sudo-based startup described in the vendor installation guide; a deployment that runs the service as an unprivileged account would see file writes limited to that account's permissions. Primary limiting factor is the need for administrative access; there is no unauthenticated path and no user interaction (UI:N) is required once admin access is held.

This is a genuine high-priority issue, corroborated across multiple signals rather than a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) describes a network-reachable, low-complexity flaw with high impact to both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), and the vuln.today decision label is act_now - the strongest urgency signal in the input. The key limiting factor is PR:H: the attacker must already hold admin privileges on Wing FTP Server, which turns this from an unauthenticated internet-wide threat into a privilege-escalation / post-authentication RCE primitive. No EPSS score, no CISA KEV listing, and no confirmed exploit code are present in the input, so there is no evidence of active exploitation or mass scanning; the risk here is driven by the severity and the act_now label, not by observed in-the-wild activity. Conflict to note explicitly: the vector is AV:N and PR:H simultaneously - remotely reachable but gated behind an administrative account - so real-world exposure depends heavily on how the Wing FTP admin interface is protected and whether admin credentials can be phished, reused, or abused by a rogue operator.

An attacker who has obtained Wing FTP Server admin access (through credential theft, reuse, or a malicious insider) scripts the creation of a user directory whose path escapes the configured base folder, then writes an arbitrary file to a sensitive filesystem location. Because the installation guide has operators launch the service with sudo, the written file is owned by root, enabling remote code execution with process-owner (root) privileges. No public exploit code is identified in the provided sources; the CERT-PL reference is an advisory, not verified working exploit code.