CVE-2026-105420 is a critical vulnerability in Wing FTP Server where the software does not verify a user's base folder. An attacker with admin privileges can exploit this by adding user directories via scripts that escape the intended base folder, enabling arbitrary file writes on the system. This can lead to remote code execution with the privileges of the process owner. Since the installation guide suggests running the server with sudo, the files may be created as root, increasing the severity of the impact. The issue was fixed in Wing FTP Server version 8.2.6.