High severity7.2NVD Advisory· Published May 12, 2026· Updated May 14, 2026
CVE-2026-44403
CVE-2026-44403
Description
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <8.1.3
Patches
Vulnerability mechanics
References
2- www.vulncheck.com/advisories/wing-ftp-server-authenticated-remote-code-execution-via-session-serializationnvdThird Party Advisory
- www.wftpserver.com/serverhistory.htmnvdRelease NotesProduct
News mentions
0No linked articles in our index yet.