High severity7.2NVD Advisory· Published May 12, 2026· Updated May 14, 2026
CVE-2026-44403
CVE-2026-44403
Description
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().
Affected products
1- Range: <8.1.3
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- www.vulncheck.com/advisories/wing-ftp-server-authenticated-remote-code-execution-via-session-serializationnvdThird Party Advisory
- www.wftpserver.com/serverhistory.htmnvdRelease NotesProduct
News mentions
0No linked articles in our index yet.