CVE-2025-47813

4.3

MEDIUM CVSS 3.1

Wing FTP Server Information Disclosure Vulnerability - [Actively Exploited]

Overview

Description

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

Details

INFO

Published Date :

July 10, 2025, 5:15 p.m.

Last Modified :

March 16, 2026, 8:20 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Mar 30, 2026 | 2 days left

Alert Date: Mar 16, 2026 | 11 days ago

Description :

Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

https://www.wftpserver.com/serverhistory.htm ; https://nvd.nist.gov/vuln/detail/CVE-2025-47813

Impact

Affected Products

The following products are affected by CVE-2025-47813 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Wftpserver	wing_ftp_server

: Total Affected Vendor : 1 | Products : 1

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	MEDIUM				[email protected]

Solution

Update Wing FTP Server to version 7.4.4 or later to address path disclosure.

Update Wing FTP Server to version 7.4.4 or later.
Remove or sanitize long UID cookie values.

Public PoC/Exploit Available at Github

CVE-2025-47813 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-47813.

URL	Resource
https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt	Exploit Third Party Advisory
https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/	Exploit Third Party Advisory
https://www.wftpserver.com	Product
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47813	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-47813 is associated with the following CWEs:

CWE-209: Generation of Error Message Containing Sensitive Information

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-47813 weaknesses.

CAPEC-7: Blind SQL Injection Blind SQL Injection CAPEC-54: Query System for Information Query System for Information CAPEC-215: Fuzzing for application mapping Fuzzing for application mapping CAPEC-463: Padding Oracle Crypto Attack Padding Oracle Crypto Attack

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

lejouni/cisa-for-bdsca

None

PowerShell Python

Updated: 1 week ago

0 stars 0 fork 0 watcher

Born at : March 18, 2026, 11:24 a.m. This repo has been linked 4 different CVEs too.

popyue/CVE-2025-47812

RCE for WingFTP v4.7.3

Python

Updated: 1 month ago

0 stars 0 fork 0 watcher

Born at : Feb. 22, 2026, 6:28 p.m. This repo has been linked 3 different CVEs too.

DevGreick/devgreick

None

Python

Updated: 5 days, 6 hours ago

1 stars 0 fork 0 watcher

Born at : Oct. 29, 2024, 8:10 p.m. This repo has been linked 11 different CVEs too.

MrTuxracer/advisories

Security Advisories

Python

Updated: 4 months, 3 weeks ago

34 stars 5 fork 5 watcher

Born at : April 30, 2019, 3:15 p.m. This repo has been linked 77 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-47813 vulnerability anywhere in the article.

TheCyberThrone

CISA adds Three Vulnerabilities to KEV Catalog

OverviewCISA has expanded its Known Exploited Vulnerabilities (KEV) catalog with three new entries this week, spanning enterprise collaboration, file transfer infrastructure, and email collaboration p ...

Published Date: Mar 19, 2026 (1 week, 1 day ago)

Daily CyberSecurity

PoC Exploit Publicly Disclosed: ‘RegPwn’ Flaw Grants SYSTEM Access via Windows Accessibility

A newly discovered vulnerability, dubbed RegPwn, has pulled back the curtain on a significant security gap in the Windows Accessibility Infrastructure. Tracked as CVE-2026-24291, this local elevation ...

Published Date: Mar 18, 2026 (1 week, 1 day ago)

Daily CyberSecurity

Leaving the Doors Unlocked: Critical 9.0 CVSS ScreenConnect Flaw Exposes Machine Keys

ConnectWise recently issued a critical security update for its ScreenConnect platform, addressing a significant vulnerability that could have allowed unauthorized actors to hijack server-level cryptog ...

Published Date: Mar 18, 2026 (1 week, 1 day ago)

Daily CyberSecurity

Edge of Disaster: Critical 9.8 CVSS Flaw in Oracle Cloud Infrastructure Toolkit Allows Complete Takeover

A critical vulnerability has been identified in a key component of Oracle’s open-source portfolio, potentially handing the keys to edge cloud environments over to unauthenticated attackers. The flaw, ...

Published Date: Mar 18, 2026 (1 week, 2 days ago)

CybersecurityNews

CISA Warns of Wing FTP Server Vulnerability Exploited in Attacks

CISA Warns Wing FTP Server Vulnerability Exploit A high-priority alert has been issued for a critical vulnerability in Wing FTP Server, added to the Known Exploited Vulnerabilities (KEV) catalog on Ma ...