Read the docs
TI-2025-30265 Aliases CVE-2025-47812GHSA-j4xf-75rr-vvrv

In Wing FTP Server before 7.4.4.

Priority CRITICAL 100Exploited in the wildCWE-158Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

Why it matters now

Exploitation Active In CISA KEV since 2025-07-14CISA due date 2025-08-04
EPSS 0.93884 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Wing FTP Server (wftpserver): 7.4.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Wing FTP ServerWing FTP Serverbefore 7.4.47.4.4Patch availableCNA
  • Wing FTP Server VendorWing FTP Server Affected before 7.4.4 Fixed in 7.4.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*before 7.4.4VulnerableWing FTP Server
  • cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:* Versions before 7.4.4 Vulnerable ·Wing FTP Server

Remediation

  • Fix · CNA Wing FTP Server (wftpserver) Fixed in 7.4.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    wftpserver Wing FTP Server 7.4.4

    3 records Highest priority Priority CRITICAL 1 CRITICAL, 2 HIGH

    Other records, highest priority first

    • TI-2025-30266 Information disclosure through error messages in Wing FTP ServerPriority HIGH 79
    • TI-2025-20621 Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of…Priority HIGH 71
    Show all 3 records →

Timeline

  1. 2025-07-14 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-47812
  3. 2026-10-03 Alias added: GHSA-j4xf-75rr-vvrv

References

Exploit 2

Advisory 2

Other 1

  • TI-2025-30266 Information disclosure through error messages in Wing FTP Server KEVCVSS 3.1MEDIUM 4.3
  • TI-2020-19167 Wing FTP Server 6.3.8 - Remote Code Execution CVSS 4.0HIGH 8.6
  • TI-2019-15321 Wing FTP Server 6.0.7 - Unquoted Service Path CVSS 4.0HIGH 8.5
  • TI-2025-20621 Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of… CVSS 3.1HIGH 8.8
  • TI-2025-04662 Wing FTP Server Lua Admin Console unnecessary privileges CVSS 4.0HIGH 7.5
  • TI-2025-30264 In Wing FTP Server through 7.4.4, the administrative web interface (listening by default… CVSS 3.1MEDIUM 6.6
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences