Actively exploited in the wild
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
Wing FTP Server - Wing FTP Server · Listed in the CISA KEV since 2025-07-14. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-47812
CriticalCVSS 10.0KEVSummary
In Wing FTP Server before 7.4.4, the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
Risk Assessment
An attacker can completely compromise the FTP server, potentially leading to data theft, file modification, and service disruption.
Recommendation
Immediately upgrade Wing FTP Server to version 7.4.4 or later and disable anonymous FTP accounts if not required.
Other vulnerabilities in Wing FTP Server
See all- CVE-2026-44403High
Wing FTP Server before version 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism. This allows authenticated administrators to inject arbitrary Lua code through the mydirectory field in the admin panel.
- CVE-2025-47813MediumActively exploited
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
Original NVD description (English source)
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.