{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incident": {
    "id": "cve-2026-105420",
    "url": "https://cveboard.org/i/cve-2026-105420",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-105420",
    "json": "https://cveboard.org/i/cve-2026-105420.json",
    "kind": "vuln",
    "live": true,
    "knownExploited": false,
    "severity": "critical",
    "title": "Wing Soft Technology Wing FTP Server",
    "summary": "Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder.",
    "titlePt": "Wing Soft Technology Wing FTP Server",
    "summaryPt": "Wing FTP Server não verifica a pasta base do usuário. Um atacante com privilégios de administrador pode adicionar diretórios de usuários via scripts, permitindo que os diretórios adicionados escapem da pasta base.",
    "affected": [
      {
        "vendor": "Wing Soft Technology",
        "product": "Wing FTP Server",
        "defaultStatus": "unaffected",
        "versions": [
          {
            "version": "0",
            "status": "affected",
            "lessThan": "8.2.6",
            "lessThanOrEqual": null
          }
        ],
        "omitted": 0,
        "fixed": [
          "8.2.6"
        ]
      }
    ],
    "omitted": 0,
    "references": [],
    "cwes": [
      {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
      }
    ],
    "ssvc": null,
    "fix": "listed",
    "tags": [
      "wing-soft-technology"
    ],
    "description": "Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.”\n\n\n\n\nThis issue was fixed in version 8.2.6.",
    "descriptionFrom": "cve",
    "descriptionAt": null,
    "summaryFrom": "cve",
    "cves": [
      "CVE-2026-105420"
    ],
    "ghsa": null,
    "cvss": {
      "score": 9.4,
      "version": "4.0",
      "by": "CERT-PL"
    },
    "epss": null,
    "packages": [],
    "vendor": "Wing Soft Technology",
    "product": "Wing FTP Server",
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "cve.now",
        "url": "https://cve.now/CVE-2026-105420"
      }
    ],
    "cveVersion": 1,
    "cvePending": false,
    "publishedAt": "2026-10-28T13:19:31.908Z",
    "updatedAt": "2026-10-28T13:19:31.908Z"
  },
  "live": true,
  "events": [
    {
      "id": "cvenow:CVE-2026-105420:cvenow_discovered:first",
      "incidentId": "cve-2026-105420",
      "type": "cvenow_discovered",
      "at": "2026-10-28T13:19:31.908Z",
      "detail": {}
    }
  ]
}