CVE-2026-44403: 
Wing FTP Server vulnerability analysis and mitigation

CVE-2026-44403 is an authenticated remote code execution (RCE) vulnerability in Wing FTP Server affecting versions before 8.1.3. The flaw resides in the session serialization mechanism, where an authenticated administrator can inject arbitrary Lua code through the domain admin mydirectory field. It was published on May 12, 2026, with a patch released in version 8.1.3. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). Wing FTP Server unsafely serializes session values — specifically the domain admin mydirectory field — directly into Lua source code without properly escaping closing delimiters. An attacker who controls an administrator account can craft a malicious value for this field that breaks out of the serialized string context and injects arbitrary Lua statements. When the server subsequently loads the poisoned session file via Lua's loadfile() function, the injected code is executed in the server's runtime context (GitHub Advisory, VulnCheck).

Successful exploitation grants an authenticated administrator the ability to execute arbitrary code on the underlying Wing FTP Server host, resulting in full compromise of confidentiality, integrity, and availability of the affected system. An attacker can read or exfiltrate sensitive data (including stored credentials and file transfer contents), modify server configurations or hosted files, and disrupt FTP service availability. While the vulnerability requires administrator-level credentials, it can serve as a privilege escalation path from a compromised admin account to full OS-level code execution, potentially enabling lateral movement within the network (GitHub Advisory, VulnCheck).

A public proof-of-concept exploit (session_poisoning_poc.py) is available on GitHub, providing detailed step-by-step instructions to achieve RCE via session poisoning and Lua code injection (PoC GitHub). The exploit has also been indexed on Exploit-DB (EDB-ID: 52589) and Sploitus, increasing its accessibility to a broader threat actor pool (Feedly). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.09% (per Feedly data), though the GitHub Advisory Database lists it at 0.621% (71st percentile). The vulnerability is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify internet-facing Wing FTP Server instances running version 8.1.2 or earlier using tools like Shodan or Censys, or by checking the server's web interface version banner.
2. Obtain administrator credentials: Acquire valid domain administrator credentials through phishing, credential stuffing, or other means — exploitation requires authenticated access to the admin panel.
3. Log in to the admin panel: Authenticate to the Wing FTP Server administrative web interface using the obtained credentials.
4. Create or modify a domain admin with a malicious payload: Navigate to the domain admin configuration and set the mydirectory field to a crafted value that injects Lua code by breaking out of the serialized string context (e.g., using a closing delimiter followed by arbitrary Lua statements such as os.execute('cmd')). The PoC script session_poisoning_poc.py automates this step.
5. Trigger session load: Log in as the poisoned domain admin account or navigate to the admin page, which causes the server to load the poisoned session file via loadfile().
6. Verify RCE: Confirm code execution by checking for a proof file created by the injected Lua payload, or observe the effects of the executed command on the server (PoC GitHub, GitHub Advisory).

• Logs: Wing FTP Server admin logs showing creation or modification of domain admin accounts with unusual or long mydirectory field values containing Lua syntax characters (e.g., ]], os.execute, io.open).
• File System: Unexpected files created in the Wing FTP Server installation or temp directories (e.g., proof-of-concept marker files, web shells, or scripts); modified or newly created Lua session files in the server's session storage directory.
• Process: Unusual child processes spawned by the Wing FTP Server process (e.g., cmd.exe, powershell.exe, bash, curl, wget) that are not part of normal FTP server operation.
• Network: Outbound connections from the Wing FTP Server host to unknown external IP addresses or C2 infrastructure, particularly following admin panel activity; unexpected DNS lookups from the server process.
• Logs: Authentication events showing a domain admin account logging in immediately after its creation or modification, followed by anomalous server-side activity (PoC GitHub, VulnCheck).

The primary remediation is to upgrade Wing FTP Server to version 8.1.3 or later, which addresses the unsafe Lua serialization in the session mechanism (Wing FTP Changelog, GitHub Advisory). As interim mitigations, administrators should restrict access to the Wing FTP Server administrative interface using network segmentation and firewall rules, limiting it to trusted management hosts only. Additionally, enforce the principle of least privilege for administrator accounts, audit existing domain admin configurations for suspicious mydirectory field values, and monitor admin panel activity for anomalous behavior.

The vulnerability was discovered and reported by VulnCheck, who published a dedicated advisory (VulnCheck). A technical write-up was published by Infinit Security shortly after disclosure (Infinit Security). The vulnerability was briefly mentioned in a Reddit cybersecurity community thread discussing recent CVE activity, though it did not generate significant standalone discussion given the requirement for authenticated administrator access.