CVE-2025-47812

Wing FTP Server versions before 7.4.4 mishandle NUL ('\0') bytes in the user and admin web interfaces, allowing attackers to inject arbitrary Lua code into user session files (CWE-158). When the crafted session file is loaded, the injected Lua runs, giving an unauthenticated attacker execution of arbitrary system commands with the privileges of the FTP service — root on Linux or SYSTEM on Windows by default — which means a total server compromise. The flaw is exploitable without credentials, including through anonymous FTP accounts, so any organization running Wing FTP Server is affected, particularly those exposing its FTP or web interfaces to the internet. Exploitation is confirmed in the wild shortly after technical details and public proof-of-concept write-ups were published; CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-07-14, and EPSS assigns a ~93% probability of exploitation within 30 days.

What to do: Upgrade to Wing FTP Server 7.4.4 or later immediately, as it is the only fixed version named in the advisory; as interim mitigation, disable anonymous FTP access and restrict the user/admin web interfaces from the internet. Hunt for signs of compromise — unexpected Lua content in user session files, commands run by the FTP service account, or newly spawned processes or webshells — because the service runs as root/SYSTEM by default and any successful exploitation implies full server control. Federal agencies must apply vendor mitigations per BOD 22-01 guidance or discontinue use of the product per the KEV listing.