TI-2025-30264 Aliases CVE-2025-47811 GHSA-r7h5-5g56-gv3h

In Wing FTP Server through 7.4.4, the administrative web interface (listening by default…

MEDIUM 62CWE-267Published 2025-07-10 · Updated 2025-07-15

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands (i.e., through the web console or the task scheduler), and they are automatically executed in the highest possible privilege context. Because administrative users of the web interface are not necessarily also system administrators, one might argue that this is a privilege escalation. (If a privileged application role is not available to an attacker, CVE-2025-47812 can be leveraged.) NOTE: the vendor reportedly considers this behavior "fine to keep."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.06186 93rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Wing FTP Server	Wing FTP Server	up to 7.4.4	—	No fix listed	CNA

Wing FTP Server VendorWing FTP Server Affected up to 7.4.4 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wftpserver:wing_ftp_server::::::::	before 7.4.4	Vulnerable	Wing FTP Server

cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:* Versions before 7.4.4 Vulnerable ·Wing FTP Server

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-47811
2026-10-03 Alias added: GHSA-r7h5-5g56-gv3h

References

Exploit 1

https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/

Other 1

https://www.wftpserver.com

TI-2025-30265 In Wing FTP Server before 7.4.4. KEVCVSS 3.1CRITICAL 10.0
TI-2025-30266 Information disclosure through error messages in Wing FTP Server KEVCVSS 3.1MEDIUM 4.3
TI-2020-19167 Wing FTP Server 6.3.8 - Remote Code Execution CVSS 4.0HIGH 8.6
TI-2019-15321 Wing FTP Server 6.0.7 - Unquoted Service Path CVSS 4.0HIGH 8.5
TI-2025-20621 Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of… CVSS 3.1HIGH 8.8
TI-2025-04662 Wing FTP Server Lua Admin Console unnecessary privileges CVSS 4.0HIGH 7.5

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences