CVE-2026-44403
HIGHWing FTP Server 8.1.2 Authenticated Remote Code Execution via Session Serialization
Title source: cnaExploitation Summary
EIP tracks 2 public exploits for CVE-2026-44403. PoCs published by Ünsal Furkan Harani, ZemarKhos.
AI-analyzed exploit summary This exploit demonstrates an authenticated RCE vulnerability in Wing FTP Server 8.1.2 by injecting arbitrary Lua code through a poisoned domain admin's 'mydirectory' field, which executes when the session is loaded via `loadfile()`.
Description
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().
Exploits (2)
This exploit demonstrates an authenticated RCE vulnerability in Wing FTP Server 8.1.2 by injecting arbitrary Lua code through a poisoned domain admin's 'mydirectory' field, which executes when the session is loaded via `loadfile()`.
This repository contains a functional exploit for CVE-2026-44403, targeting Wing FTP Server v8.1.2. The exploit leverages a session serialization vulnerability in Lua's long-string notation to achieve remote code execution by injecting malicious payloads into the admin's basefolder field.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H