Wing FTP Server EUVD-2026-115225

Requires a valid authenticated low-privileged web-client account on Wing FTP Server prior to version 8.2.6 (PR:L). The attacker sends a crafted nowpath parameter to webclient/makethumb.html; the payload must break out of the CDATA section in the admin_get_lastconn.html XML to forge a connection id. Execution additionally requires an administrator to have the admin_connection_list.html activity page open - the page's auto-refresh then renders and executes the stored script (UI:P, passive rather than an active click). Limiting factors: exploitation is impossible without web-client credentials, depends on an admin actually viewing the legacy activity/connection-list page, and is remediated entirely by upgrading to 8.2.6. No non-default feature toggle is named in the sources as a prerequisite.

This is a medium-severity stored XSS (CVSS 4.0 base 5.1) whose signals point to a real-but-not-urgent issue rather than a drop-everything emergency. The attack vector is network (AV:N) with low complexity (AC:L) and no special attack requirements (AT:N), but exploitation requires an authenticated low-privileged web-client account (PR:L) and passive user interaction (UI:P) - specifically an administrator having the activity page open while it auto-refreshes. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The vuln is NOT on CISA KEV and no verified working exploit code is in the input, so there is no evidence of active exploitation. The reporting source's priority decision label is 'this_month', indicating it should be remediated within a normal monthly patch cycle, not treated as act_now/emergency. The one factor that elevates concern beyond the modest CVSS numbers is the stated outcome: the injected script runs in an administrator's browser and enables Lua console abuse, which in Wing FTP Server can translate to server-side command execution - a privilege-escalation pivot from a low-privileged user to admin-equivalent control. That downstream impact is reflected only as SC:L/SI:L in the provided 4.0 vector, so there is tension between the conservative impact metrics and the described Lua console consequence; teams should weight the escalation path, not just the 5.1 number.

A low-privileged user with valid Wing FTP web-client credentials sends a crafted nowpath parameter to webclient/makethumb.html, storing a payload that breaks out of the CDATA section in the admin_get_lastconn.html XML to forge a connection id. When an administrator has admin_connection_list.html open, its auto-refresh renders the forged entry and executes the attacker's script in the admin's authenticated session, which can be leveraged to abuse the Lua console. No public exploit code is identified in the available data, though VulnCheck published a technical advisory describing the technique.