Wing FTP Server 8.1.3 RCE: Authenticated Admins Can Inject and Execute Lua Code

Wing FTP Server versions up to and including 8.1.2 contain a remote code execution vulnerability that allows an authenticated administrator to inject arbitrary Lua code through the domain admin configuration. The flaw, tracked as CVE-2026-44403, has been fixed in version 8.1.3.

The attack works through the web admin panel on its default port 5466. An attacker with full admin credentials (not readonly or domain admin) can create a new domain admin account with a poisoned “mydirectory” (basefolder) field. The value injected into this field gets embedded into a session file that is later loaded and executed server-side via Lua’s loadfile() function.

The payload breaks out of the session file’s long string delimiter using a crafted value like /tmp/x]]–. When the session loads, the Lua code executes as the Wing FTP Server service account. The payload also re-executes every time the poisoned session is loaded, giving the attacker persistence.

Prerequisites for exploitation include valid full admin credentials and access to the web admin panel. Organizations running Wing FTP Server should upgrade to version 8.1.3 immediately and audit their admin accounts for any suspicious domain admin entries.

References

• CVE-2026-44403 — NVD
• Exploit-DB: Wing FTP Server Authenticated RCE
• Wing FTP Server