CVE-2025-47812: critical vulnerability in wftpserver Wing FTP Server
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Wing FTP Server has a critical flaw where null bytes in the web interface allow attackers to inject malicious code into session files, leading to complete server takeover. This can be exploited remotely even through anonymous accounts.
The vulnerability exploits improper null byte handling in Wing FTP Server's user and admin web interfaces, allowing injection of arbitrary Lua code into session files. Successful exploitation results in remote code execution with FTP service privileges (typically root/SYSTEM), requiring only network access and no authentication if anonymous FTP is enabled.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.