Is CVE-2026-120491 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-120491?

CVE-2026-120491 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-120491

Description

Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, enabling Lua console abuse.