CVE-2020-37032 Wing FTP Server 6.3.8 - Remote Code Execution
Authenticated attackers can execute arbitrary system commands via the Lua-based web console in Wing FTP Server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-37032?
CVE-2020-37032 is a high-severity command injection vulnerability in Wing FTP Server, published on 30 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.
Weakness: CWE-78
Which versions are affected by CVE-2020-37032?
It affects 1 product.
Products include Wftpserver Wing Ftp Server.
How do I fix CVE-2020-37032?
No fix has been published for CVE-2020-37032 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-37032 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37032 exists.
Other vulnerabilities in Wing FTP Server
- CVE-2025-47812 Wing FTP Server Improper Neutralization of Null Byte or NUL Character
- CVE-2025-47813 Wing FTP Server Information Disclosure
- CVE-2026-44403 Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization
- CVE-2019-25267 Wing FTP Server 6.0.7 - Unquoted Service Path
- CVE-2020-9470 Information disclosure in n/a
Sources
Also known as GHSA-h3x8-7gw7-p9rx.