Critical Wing FTP Server vulnerability exploited in the wild (CVE-2025-47812)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-27889+1 related CVE | Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary… | 8.8 group max | <1% | PoC ×2 | |
CVE-2025-47812+1 related CVE | Unauthenticated RCE in Wing FTP Server via null-byte Lua injection | 10.0 group max | 94% | KEVPoC ×2 | KEV |
From the original article
3 min read at helpnetsecurity.com
Threat actors are actively exploiting a recently fixed remote code execution vulnerability (CVE-2025-47812) in Wing FTP Server, security researchers have warned. Wing FTP Server is a commercial file transfer server solution used by businesses, MSPs and hosting providers. The software can be installed on 64-bit operating systems: Windows, Windows Server, Linux, and macOS.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.