CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-47812 +1 in the same advisory: …47813 | Unauthenticated RCE in Wing FTP Server via null-byte Lua injection Wing FTP Server versions before 7.4.4 mishandle NUL ('\0') bytes in the user and admin web interfaces, allowing attackers to inject arbitrary Lua code into user session files (CWE-158). When the crafted session file is loaded, the injected Lua runs, giving an unauthenticated attacker execution of arbitrary system commands with the privileges of the FTP service — root on Linux or SYSTEM on Windows by default — which means a total server compromise. The flaw is exploitable without credentials, including through anonymous FTP accounts, so any organization running Wing FTP Server is affected, particularly those exposing its FTP or web interfaces to the internet. Exploitation is confirmed in the wild shortly after technical details and public proof-of-concept write-ups were published; CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-07-14, and EPSS assigns a ~93% probability of exploitation within 30 days. Do: Upgrade to Wing FTP Server 7.4.4 or later immediately, as it is the only fixed version named in the advisory; as interim mitigation, disable anonymous FTP access and restrict the user/admin web interfaces from the internet. Hunt for signs of compromise — unexpected Lua content in user session files, commands run by the FTP service account, or newly spawned processes or webshells — because the service runs as root/SYSTEM by default and any successful exploitation implies full server control. Federal agencies must apply vendor mitigations per BOD 22-01 guidance or discontinue use of the product per the KEV listing. | 10.0 group max | 93% | KEV PoC ×2 |
| moderate≈ several thousand internet-exposed Wing FTP Server instances (estimate; total installed base likely tens of thousands) |
Full article343 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 17, 2026Vulnerability / Network Security
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a medium-severity security flaw impacting Wing FTP to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerability, CVE-2025-47813 (CVSS score: 4.3), is an information disclosure vulnerability that leaks the installation path of the application under certain conditions.
"Wing FTP Server contains a generation of error messages containing sensitive information vulnerability when using a long value in the UID cookie," CISA said.
The shortcoming affects all versions of the software prior to and including version 7.4.3. The issue was addressed in version 7.4.4, shipped in May following a responsible disclosure by RCE Security researcher Julien Ahrens.
It's worth noting that version 7.4.4 also patches CVE-2025-47812 (CVSS score: 10.0), another critical bug in the same product that allows for remote code execution. As of July 2025, the vulnerability has come under active exploitation in the wild.
According to details shared by Huntress at the time, attackers have leveraged it to download and execute malicious Lua files, conduct reconnaissance, and install remote monitoring and management software.
Ahrens, in a proof-of-concept (PoC) exploit, shared on GitHub, noted that the endpoint at "/loginok.html" does not properly validate the value of the "UID" session cookie. As a result, if the supplied value is longer than the maximum path size of the underlying operating system, it triggers an error message that discloses the full local server path.
"Successful exploits can allow an authenticated attacker to get the local server path of the application, which can help in exploiting vulnerabilities like CVE-2025-47812," the researcher added.
There are currently no details on how the vulnerability is being exploited in the wild, and if it's being abused in conjunction with CVE-2025-47812. In light of the latest development, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the necessary fixes by March 30, 2026.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/03/cisa-flags-actively-exploited-wing-ftp.html