High severity · published Jan 30, 2026
CVE-2020-37032
Wing FTP Server 6.3.8 - Remote Code Execution
8.8
CVSS
1.2%
EPSS
No
On KEV
Description
Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Wing FTP Server · Wing FTP Server
6.3.8 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37032
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37032
Exploit
https://www.exploit-db.com/exploits/48676
Broken Link
https://www.vulncheck.com/advisories/wing-ftp-server-remote-code-execution
Product
https://www.wftpserver.com/
More from Wing FTP Server
10.0
CVE-2025-47812
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
4.3
CVE-2025-47813
Wing FTP Server Information Disclosure Vulnerability
7.2
CVE-2026-44403
Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization
3.5
CVE-2020-37079
Wing FTP Server < 6.2.7 - Cross-site Request Forgery