Actively exploited in the wild
Wing FTP Server Information Disclosure Vulnerability
Wing FTP Server - Wing FTP Server · Listed in the CISA KEV since 2026-03-16. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-47813
MediumCVSS 4.3KEVSummary
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
Risk Assessment
Disclosure of the installation path may help an attacker plan further attacks, such as path-related exploits.
Recommendation
Update Wing FTP Server to version 7.4.4 or later.
Other vulnerabilities in Wing FTP Server
See all- CVE-2026-120491Medium
Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script via a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id that executes in administrators' browsers.
- CVE-2026-44403High
Wing FTP Server before version 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism. This allows authenticated administrators to inject arbitrary Lua code through the mydirectory field in the admin panel.
- CVE-2026-105420Critical
Wing FTP Server does not verify the user's base folder, allowing an attacker with admin privileges to add user directories via scripts that escape the base folder. This enables file writes on the system and potential remote code execution with process owner privileges, and with sudo-based installation files are created as root. Fixed in version 8.2.6.
- CVE-2025-47812CriticalActively exploited
In Wing FTP Server before 7.4.4, the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
Original NVD description (English source)
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS