Description
Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, enabling Lua console abuse.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Wing FTP Software | Wing FTP Server | < 8.2.6 | 8.2.6 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
3jee/CVE-2026-120491 ★ 1 · Nov 6, 2026
Python PoC for my first CVE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://www.wftpserver.com/serverhistory.htm vendor-advisory release-notes
- VulnCheck Advisory: Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page third-party-advisory