CVE-2020-37079: Wftpserver Wing FTP Server

Low severity, CVSS 3.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users. Attackers can craft a malicious HTML page with a hidden form to submit a request that deletes the administrative user account without proper authorization.

Affected products

• Wftpserver Wing FTP Server: before 6.2.7 (fixed in 6.2.7)

Published 2026-02-07. Last modified 2026-06-17.