Wing FTP Server fails to enforce the user's base folder, letting an attacker with administrative rights create new user directories via scripts that escape the intended directory structure. The attacker can then write arbitrary files to the host file system and, because the server often runs under root (the installation guide recommends using sudo), those files are created as root. This capability allows the attacker to place malicious executables or scripts in privileged locations and trigger remote code execution with full process owner privileges.

Wing Soft Technology's Wing FTP Server, all releases prior to version 8.2.6. The vulnerability applies to any installation where the base folder restriction is not correctly validated, especially in environments that use the default or sudo‑based configuration.

The flaw carries a CVSS score of 9.4, reflecting a high‑severity remote exploit that requires only that the attacker obtain administrative privileges on the FTP server. While no EPSS data is currently published, the lack of a KEV listing does not diminish the risk— the attack path is straightforward and leverages existing server scripts, meaning an attacker who can influence script execution will effectively control the host as root. The possibility of executing arbitrary code with root privileges makes this a critical threat for any exposed FTP service.