Executive brief
Wing FTP Server is a professional file transfer solution used by organizations to manage and share data. A critical security flaw allows unauthenticated attackers to take complete control of the server by injecting malicious code. This vulnerability is currently being exploited in the wild and can lead to total data theft or a complete service shutdown.
Technical details
Wing FTP Server before version 7.4.4 is vulnerable to an improper neutralization of null bytes (CWE-158) within its user and admin web interfaces. By mishandling '\0' characters, the application allows an attacker to inject arbitrary Lua code into user session files. This code is subsequently executed with the high-level privileges of the FTP service (typically root on Linux or SYSTEM on Windows). The vulnerability is reachable over the network without authentication and has been confirmed to be exploitable via anonymous FTP accounts. A patch is available in version 7.4.4.
Affected products
- Wing FTP Server Wing FTP Server before 7.4.4
Timeline
- 2025-07-10: disclosed
- 2025-07-14: advisory
- 2025-07-14: kev added: Added to CISA KEV catalog due to active exploitation.
- 2025-07-14: exploited