High severity · published Jan 30, 2026
CVE-2020-37032
Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands
8.8
CVSS
1.2%
EPSS
No
On KEV
Description
Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Wing Ftp Server · Wftpserver
6.3.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37032
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37032
Exploit
https://www.exploit-db.com/exploits/48676
Broken Link
https://www.vulncheck.com/advisories/wing-ftp-server-remote-code-execution
Product
https://www.wftpserver.com/
More from Wing Ftp Server
10.0
CVE-2025-47812
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
4.3
CVE-2025-47813
Wing FTP Server Information Disclosure Vulnerability
8.8
CVE-2025-27889
Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link
8.8
CVE-2023-37881
Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0
8.8
CVE-2023-37878
Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0