CVE-2026-44403 Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization

What is CVE-2026-44403?

CVE-2026-44403 is a high-severity code injection vulnerability in Wing FTP Server, published on 12 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().

Weakness: CWE-94

Which versions are affected by CVE-2026-44403?

It affects 1 product.

Products include Wftpserver Wing Ftp Server.

How do I fix CVE-2026-44403?

No fix has been published for CVE-2026-44403 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-44403 being exploited?

There is no known exploitation of CVE-2026-44403 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Other vulnerabilities in Wing FTP Server

• CVE-2025-47812 Wing FTP Server Improper Neutralization of Null Byte or NUL Character Exploited Critical 10.0
• CVE-2025-47813 Wing FTP Server Information Disclosure Exploited Medium 4.3
• CVE-2020-37032 Wing FTP Server 6.3.8 - Remote Code Execution High 8.6
• CVE-2019-25267 Wing FTP Server 6.0.7 - Unquoted Service Path High 8.5
• CVE-2020-9470 Information disclosure in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-ffh5-r5xj-cgmg.