CVE-2026-120491Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page

Descripción

Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, enabling Lua console abuse.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://www.wftpserver.com/serverhistory.htm vendor-advisoryrelease-notes
• VulnCheck Advisory: Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page third-party-advisory