CVE-2025-47813

Published Jul 10, 2025

Last updated a month ago

Exploit known CVSS medium 4.3

Wing FTP Server

IoT

XSS

FTP

Server

Rdp

Port (21)

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-47813 is a local path disclosure vulnerability affecting Wing FTP Server versions prior to 7.4.4. This flaw, classified as CWE-209 (Generation of Error Message Containing Sensitive Information), allows an attacker to uncover the full local installation path of the application. The vulnerability is triggered by manipulating the `UID` cookie with an excessively long value when accessing the `loginok.html` functionality, which causes an error message to be generated that includes the sensitive path information. The exposure of the server's file system structure through this vulnerability could potentially be leveraged by attackers to aid in further attacks or to gain a deeper understanding of the target system's configuration. The issue was addressed in Wing FTP Server version 7.4.4, released on May 14, 2025.

Description: loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
Source: cve@mitre.org
NVD status: Analyzed
Products: wing_ftp_server

Risk scores

CVSS 3.1

Type: Secondary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Known exploits

Data from CISA

Vulnerability name: Wing FTP Server Information Disclosure Vulnerability
Exploit added on: Mar 16, 2026
Exploit action due: Mar 30, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

cve@mitre.org: CWE-209

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "34AF9E83-291C-40B0-AE69-34C9B59A5D03",
            "versionEndExcluding": "7.4.4",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.