What’s Vulnerable › Vulnerabilities

CVE-2020-37079: Wing FTP Server < 6.2.7 - Cross-site Request Forgery

• Severity: low (CVSS 3.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-07 · updated 2026-06-17
• Weakness: CWE-352

Description

Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users. Attackers can craft a malicious HTML page with a hidden form to submit a request that deletes the administrative user account without proper authorization.

Affected products

• Wing FTP Server: before 6.2.7 — fixed in 6.2.7

How to fix

Upgrade to a fixed version: Wing FTP Server 6.2.7. Check the vendor advisory for mitigations.

References

• https://www.exploit-db.com/exploits/48200
• https://www.vulncheck.com/advisories/wing-ftp-server-cross-site-request-forgery
• https://www.wftpserver.com
• https://www.wftpserver.com/serverhistory.htm

Get alerted when CVE-2020-37079 or the next vulnerability affects your stack