CVE-2025-47812 - CVE House
Back to Database
Status published Critical CVE-2025-47812

In Wing FTP Server before 7.4.4. the user and admin...

Vulnerability Description

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-47812

Credits & Attribution

No credits recorded in the NVD database.

References

More from wftpserver

View All →
CVE-2025-47813
loginok.html in Wing FTP Server before 7.4.4 discloses the full...
Medium 4.3
CVE-2025-47811
In Wing FTP Server through 7.4.4, the administrative web interface...
Medium 4.1
CVE-2025-27889
Wing FTP Server before 7.4.4 does not properly validate and...
Low 3.4
CVE-2020-9470
An issue was discovered in Wing FTP Server 6.2.5 before...
High 7.8
CVE-2020-8635
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets...
High 7.8

Affected Vendor

Affected Software

Wing FTP Server
Vulnerable Versions:
0

Timeline

Official Publish: July 10th, 2025
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-158

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.