Actively exploited in the wild

Wing FTP Server Information Disclosure Vulnerability

Wing FTP Server - Wing FTP Server · Listed in the CISA KEV since 2026-03-16. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-47813

MediumCVSS 4.3KEV

Published: 10/07/2025(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

Risk Assessment

Disclosure of the installation path may help an attacker plan further attacks, such as path-related exploits.

Recommendation

Update Wing FTP Server to version 7.4.4 or later.

Other vulnerabilities in Wing FTP Server

CVE-2026-44403High
Wing FTP Server before version 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism. This allows authenticated administrators to inject arbitrary Lua code through the mydirectory field in the admin panel.

Original NVD description (English source)

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.