CVE-2026-120491: Stored XSS in Wing FTP Server Admin Console

CVE-2026-120491 is a stored cross-site scripting (XSS) vulnerability in Wing FTP Server before version 8.2.6. The flaw resides in the nowpath parameter of the webclient/makethumb.html page and allows authenticated FTP users to inject JavaScript that is stored in the database. When administrators visit the admin_connection_list.html page (which auto-refreshes), the injected script executes in the context of their browser, compromising FTP connection management.

The CVSS score is 5.4 (medium), but the vulnerability enables a serious escalation path: an ordinary FTP user injects code that executes in the administrator's browser, abusing the integrated Lua console to achieve code execution directly on the server. The patch is available immediately (version 8.2.6), but the GitHub signal dated 2026-11-06 indicates that exploit code is already documented publicly, increasing the risk of active exploitation.

IT teams must immediately inventory all Wing FTP Server systems and update to version 8.2.6 or later without delay. It is recommended to increase monitoring of admin console access and administrator browser logs to detect XSS injection attempts. Review Lua console configurations, limiting execution permissions to the minimum necessary and verifying the rights of authenticated FTP users.