CVE-2025-47812: Wing FTP Server remote code execution via null byte injection

CVE-2025-47812 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2025-07-14

Wing FTP Server is a professional file transfer solution used by organizations to manage and share data. A critical security flaw allows unauthenticated attackers to take complete control of the server by injecting malicious code. This vulnerability is currently being exploited in the wild and can lead to total data theft or a complete service shutdown.

Technologies: Wing FTP Server. Vendors: Wing FTP Server.

Quick answers

Is CVE-2025-47812 exploited in the wild?
Yes. CVE-2025-47812 is known to be exploited in the wild, first recorded on 14 July 2025. Treat it as urgent.
How severe is CVE-2025-47812?
Critical severity, with a CVSS score of 10, published 14 July 2025.
Which products and versions are affected?
Wing FTP Server Wing FTP Server before 7.4.4.
Is there a fix for CVE-2025-47812?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-47812 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-47812?
Check whether you run Wing FTP Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Wing FTP Server before version 7.4.4 is vulnerable to an improper neutralization of null bytes (CWE-158) within its user and admin web interfaces. By mishandling '\0' characters, the application allows an attacker to inject arbitrary Lua code into user session files. This code is subsequently executed with the high-level privileges of the FTP service (typically root on Linux or SYSTEM on Windows). The vulnerability is reachable over the network without authentication and has been confirmed to be exploitable via anonymous FTP accounts. A patch is available in version 7.4.4.

Affected products

  • Wing FTP Server Wing FTP Server before 7.4.4

Timeline

  • 2025-07-10: disclosed
  • 2025-07-14: advisory
  • 2025-07-14: kev added: Added to CISA KEV catalog due to active exploitation.
  • 2025-07-14: exploited

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.