CVE-2025-47813mediumunder attackCWE-209

CVE-2025-47813: medium-severity vulnerability in wftpserver Wing FTP Server

Published · Updated

Follow this CVE+ Monitor Wing FTP Server+ Monitor Wing FTP Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

90Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 4.3epss 63%
from disclosure to weapon485 days
Published on NVDJul 10
1st PoC+485d
CISA KEV+249d
Action required by CISAfederal deadline: 2026-03-30

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Wing FTP Server reveals where it is installed on the computer when someone tampers with a cookie. This information leak could help an attacker plan further attacks.

Technical detail

CWE-209 information disclosure vulnerability in loginok.html: improper input validation on the UID cookie parameter causes the application to expose the full local installation path in error messages or responses. Requires attacker to craft a malicious UID cookie value; impacts confidentiality by disclosing installation directory which may aid reconnaissance for subsequent attacks.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
wftpserver · Wing FTP Server
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — wftpserver Wing FTP Server

In the same product, most dangerous first.

CVE-2025-47812CRITICALCVE-2025-47812EPSS 93.9%KEVCVE-2025-47811MEDIUMCVE-2025-47811EPSS 6.2%CVE-2025-27889LOWCVE-2025-27889EPSS 0.5%