Latest Wing FTP Server vulnerabilities #
Multiple vulnerabilities were disclosed in certain versions of Wing FTP Server. There is evidence that the one of the vulnerabilities, designated by CVE-2025-47812, is being actively exploited in the wild.
- The web interface authentication process improperly neutralizes a NULL byte appended to the username. This vulnerability would allow a remote authenticated adversary, or an unauthenticated adversary through use of an anonymous FTP account if one is enabled, to inject arbitrary Lua code into the user session file. The Lua code would be executed whenever the session file is loaded, for example upon request to any of the authenticated portions of the web interface. This would allow remote code execution with the privileges the service (root or SYSTEM by default). This vulnerability has been designated CVE-2025-47812 and has been rated critical with a CVSS score of 10.0.
- The loginok.html endpoint does not correctly validate the UID session cookie. When provided a cookie value that exceeds the operating system's maximum path size, it results in an error message that discloses the full local installation path of the application. An authenticated adversary may exploit the vulnerability to obtain the local installation path, which may aid in exploiting CVE-2025-47812. This vulnerability has been designated CVE-2025-47813 and has been rated medium with a CVSS score of 4.3.
- The downloadpass.html endpoint does not properly validate and sanitize the URL parameter, allowing injection of an arbitrary link. Successful exploitation by an adversary may result in cleartext password disclosure to the injected link by convincing a victim to navigate to a specially crafted URL, enter their password and submit the form. This vulnerability has been designated CVE-2025-27889 and has been rated low with a CVSS score of 3.4.
The following versions are affected
- Wing FTP Server versions prior to 7.4.4
What is the impact? #
Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Are any updates or workarounds available? #
Users are encouraged to update Wing FTP Server to version 7.4.4 or later as quickly as possible.
How to find Wing FTP Server installations with runZero #
From the Service Inventory, use the following query to locate potentially impacted assets:
vendor:=WFTPServer AND product:="Wing FTP Server"
