anonhaven

CVE-2025-47813

MEDIUM CVSS 3.1: 4.3 EPSS 63.0% ACTIVE EXPLOIT
Updated Mar 16, 2026
Wftpserver

CISA Known Exploited Vulnerability (KEV)

This vulnerability is actively exploited in the wild. Immediate patching is strongly recommended.

Due Date: Mar 30, 2026

Parameter Value
CVSS 4.3 (MEDIUM)
Affected Versions before 7.4.4
Fixed In 7.4.4
Type CWE-209 (Information Exposure Through Error Message)
Vendor Wftpserver
Public PoC Yes

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-209 Information Exposure Through Error Message

Vulnerable Products 1

Configuration From (including) Up to (excluding)
Wftpserver Wing_Ftp_Server
cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*
 — 7.4.4

References 4

https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt
cve@mitre.org
https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-…
cve@mitre.org
https://www.wftpserver.com
cve@mitre.org
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025…
134c704f-9b21-4f2e-91b3-4a467353bcc0
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-44403

Wftpserver

8.6

CVE-2025-47812

Wftpserver

10.0