TI-2025-04662 Aliases CVE-2025-5196 GHSA-xh8q-jh7v-55g2

Wing FTP Server Lua Admin Console unnecessary privileges

HIGH 68CWE-250Published 2025-05-26 · Updated 2025-05-28

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-250.

Summary

A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Lua Admin Console. The manipulation leads to execution with unnecessary privileges. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 7.4.4 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "[W]e do not consider it as a security vulnerability, because the system admin in WingFTP has full permissions [...], but you can suggest the user run WingFTP service as Normal User rather than SYSTEM/Root, it will be safer."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01119 66th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Wing	FTP Server	7.4.0; 7.4.1; 7.4.2; 7.4.3	—	No fix listed	CNA

FTP Server VendorWing Affected 7.4.0; 7.4.1; 7.4.2; 7.4.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wftpserver:wing_ftp_server::::::::	before 7.4.4	Vulnerable	Wing FTP Server

cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:* Versions before 7.4.4 Vulnerable ·Wing FTP Server

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-5196
2026-10-03 Alias added: GHSA-xh8q-jh7v-55g2

References

Exploit 1

https://github.com/Nouvexr/Wing-FTP-Server-7.4.4-RCE-Authenticated/blob/main/poc.txt

Patch 1

https://www.wftpserver.com/serverhistory.htm

TI-2025-30265 In Wing FTP Server before 7.4.4. KEVCVSS 3.1CRITICAL 10.0
TI-2025-30266 Information disclosure through error messages in Wing FTP Server KEVCVSS 3.1MEDIUM 4.3
TI-2020-19167 Wing FTP Server 6.3.8 - Remote Code Execution CVSS 4.0HIGH 8.6
TI-2019-15321 Wing FTP Server 6.0.7 - Unquoted Service Path CVSS 4.0HIGH 8.5
TI-2025-20621 Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of… CVSS 3.1HIGH 8.8
TI-2025-30264 In Wing FTP Server through 7.4.4, the administrative web interface (listening by default… CVSS 3.1MEDIUM 6.6

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences