CVE-2026-120491 in Server
Summary
by MITRE • 11/02/2026
Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, enabling Lua console abuse.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in Wing FTP Server prior to version 8.2.6 represents a critical security flaw rooted in insufficient input validation and improper encoding of user-supplied data within the web-based administrative interface. This issue manifests primarily as a stored cross-site scripting (XSS) attack vector, allowing authenticated users with access to specific web client functionalities to inject malicious script payloads into the application's response streams. The primary entry point for this exploitation is located in the handling of the nowpath parameter when interacting with the webclient/makethumb.html endpoint. Because the server fails to adequately sanitize or encode special characters within this parameter before storing it, an attacker can persistently embed executable JavaScript code that remains active on the server side until explicitly removed by an administrator.
The operational impact of this vulnerability is significantly amplified by its ability to facilitate privilege escalation through session manipulation and context switching between standard user roles and administrative privileges. The attack chain involves a sophisticated technique where adversaries exploit weaknesses in XML parsing logic within admin_get_lastconn.html. By carefully crafting the input, attackers can break out of the directory CDATA section used for data representation. This breakout allows them to forge or manipulate connection identifiers that are subsequently processed by other components of the application. Specifically, when the administrative interface page admin_connection_list.html performs its automatic refresh cycle, it retrieves and renders this forged connection ID without proper validation.
This sequence results in the execution of arbitrary JavaScript code within the context of an administrator's browser session. Since the script executes with the privileges of the logged-in administrator, the consequences are severe. The attacker gains the ability to perform actions typically reserved for system administrators, including accessing sensitive configuration files, modifying user accounts, or executing commands via exposed administrative APIs. A particularly dangerous outcome highlighted in reports is the potential abuse of the Lua console functionality available within the admin interface. By injecting scripts that trigger this console, an attacker can execute arbitrary server-side code with high-level privileges, effectively achieving remote code execution on the underlying system hosting Wing FTP Server.
From a classification perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involving XML manipulation and CDATA section escaping issues also relates to CWE-14, Compiler Injection, although in the context of web applications it is often categorized under broader input validation failures such as CWE-20. In terms of tactical behavior within the MITRE ATT&CK framework for enterprise security, this exploitation path corresponds to T1059 Command and Scripting Interpreter, specifically through JavaScript execution via browser-based interfaces, and potentially T1078 Valid Accounts if the initial access relies on compromised credentials or weak authentication mechanisms that allow unauthorized users to reach the vulnerable endpoints.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Administrators running versions of Wing FTP Server earlier than 8.2.6 should upgrade to the latest patched version immediately, where these input validation checks and encoding routines have been corrected. In environments where patching is not instantly feasible, network-level controls such as Web Application Firewalls can be configured to detect and block requests containing suspicious patterns associated with XSS payloads or malformed XML structures targeting the identified endpoints. Additionally, enforcing strict Content Security Policy headers on the web client interface can help mitigate the impact of any successfully injected scripts by restricting the sources from which executable content is allowed to load, thereby reducing the effectiveness of the attack even if input validation fails. Regular auditing of administrative access logs and implementing multi-factor authentication for all admin accounts further reduces the risk surface associated with this vulnerability.