CVE-2025-47813
Wing FTP Server Information Disclosure Vulnerability
Description
CVE-2025-47813 is a medium severity information exposure vulnerability in Wing FTP Server. The flaw exists in the loginok.html page, which discloses the full local installation path of the Wing FTP Server when a user submits a long UID cookie value. This path disclosure provides attackers with valuable reconnaissance information that can facilitate further exploitation. Affected versions include Wing FTP Server prior to 7.4.4. With a CVSS v3.1 score of 4.3 (MEDIUM) and an EPSS score of 21.4%, CVE-2025-47813 is being actively exploited despite its relatively low severity rating. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on March 16, 2026, with a remediation deadline of March 30, 2026.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| wftpserver | wing ftp server | < 7.4.4 |
References
- https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt(Exploit, Third Party Advisory)
- https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/(Exploit, Third Party Advisory)
- https://www.wftpserver.com(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47813(US Government Resource)
Weakness Type
CWE-209: Generation of Error Message Containing Sensitive Information
CVE-2025-47813 is classified under CWE-209 (Generation of Error Message Containing Sensitive Information). This weakness occurs when an application generates error messages or responses that contain sensitive system information such as file paths, stack traces, database details, or internal configuration data that should not be exposed to users.
In CVE-2025-47813, the Wing FTP Server's loginok.html page processes UID cookie values without proper bounds checking. When an excessively long UID cookie value is submitted, the server response includes the full local filesystem path where Wing FTP Server is installed. This information disclosure reveals the server's operating system, directory structure, and installation location, providing attackers with critical reconnaissance data for crafting targeted attacks against the server.
Learn more: CWE-209 — Generation of Error Message Containing Sensitive Information
Impact Analysis
CVE-2025-47813 carries a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The attack is network-accessible with low complexity and requires low-level authentication, with no user interaction needed. The scope is Unchanged.
Confidentiality (Low): The vulnerability exposes the full local installation path of the Wing FTP Server. While this is rated Low in the CVSS assessment, the disclosed path reveals the operating system type, drive letter or mount point, directory naming conventions, and potentially the username under which the service is installed. This information is valuable for attackers planning subsequent attacks, particularly for path traversal exploits, file inclusion attacks, or targeted exploitation of other vulnerabilities that require knowledge of absolute file paths.
Integrity (None): The vulnerability does not allow modification of any data or system configuration.
Availability (None): The vulnerability does not impact system availability.
Despite the moderate CVSS score, the EPSS score of 21.4% is remarkably high for an information disclosure vulnerability, indicating that attackers are actively using this flaw as part of multi-stage attack chains. The path disclosure likely serves as a reconnaissance step that enables exploitation of more severe vulnerabilities in Wing FTP Server or the underlying operating system.
Exploit Maturity
CVE-2025-47813 demonstrates surprisingly high exploit maturity for an information disclosure vulnerability. CISA added it to the Known Exploited Vulnerabilities catalog on March 16, 2026, with a remediation deadline of March 30, 2026. The EPSS score of 21.4% is exceptionally high for a MEDIUM severity vulnerability, placing it well above most critical-rated CVEs in terms of actual exploitation probability.
The exploitation technique is trivial: an authenticated attacker simply sends a request to loginok.html with an oversized UID cookie value and reads the disclosed installation path from the response. This simplicity, combined with the value of the disclosed information for chaining with other exploits, explains the high exploitation rate. Wing FTP Server instances are commonly deployed on both Windows and Linux systems, and knowledge of the exact installation path enables targeted exploitation of file system-based vulnerabilities.
The inclusion in the KEV catalog despite the low CVSS score suggests that this vulnerability is being actively used as part of attack chains targeting Wing FTP Server deployments, likely in combination with other vulnerabilities that require path knowledge for successful exploitation.
Remediation
-
Update Wing FTP Server to version 7.4.4 or later. This version addresses the information disclosure in loginok.html. The update should be applied to all Wing FTP Server instances regardless of whether they are internet-facing.
-
Restrict access to the Wing FTP Server web administration interface. Ensure the web-based management interface is not exposed to the internet. Use firewall rules to limit access to trusted management networks and IP addresses only.
-
Implement a web application firewall (WAF) or reverse proxy. Deploy a WAF in front of the Wing FTP Server that can filter requests with oversized cookie values. Configure rules to reject requests with cookies exceeding reasonable size limits.
-
Review server logs for exploitation attempts. Search web server access logs for requests to loginok.html with unusually large cookie values. Any such requests may indicate reconnaissance activity and should be investigated for associated exploitation attempts against other Wing FTP Server endpoints.
-
Audit Wing FTP Server configurations for additional hardening. Review user accounts, access permissions, and enabled features. Disable any unnecessary services or features that could expand the attack surface. Ensure strong authentication is enforced for all accounts.
-
Monitor for chained attacks. Since path disclosure is typically a reconnaissance step, investigate any systems where CVE-2025-47813 exploitation was detected for signs of subsequent attacks, including unauthorized file access, privilege escalation, or lateral movement.
Technical Details
CVE-2025-47813 is an information exposure vulnerability in Wing FTP Server affecting versions prior to 7.4.4. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, yielding a score of 4.3. The vulnerability resides in the loginok.html page of the Wing FTP Server's web interface. When an authenticated user submits an HTTP request with an excessively long UID cookie value, the server's response handling logic fails to properly sanitize the error output and includes the full local filesystem path of the Wing FTP Server installation directory. This path disclosure occurs because the application's error handling routine concatenates the installation path into the response when processing the malformed cookie, revealing information such as the drive letter (on Windows), the full directory tree, and the installation folder name. The low privilege requirement (PR:L) means any authenticated user, including those with minimal FTP access, can trigger the disclosure through the web interface.
Frequently Asked Questions
Is CVE-2025-47813 being actively exploited?
Yes. CISA added CVE-2025-47813 to the Known Exploited Vulnerabilities catalog on March 16, 2026. Despite its moderate CVSS score of 4.3, the EPSS score of 21.4% indicates very active exploitation, likely as part of multi-stage attack chains.
What products are affected by CVE-2025-47813?
Wing FTP Server versions prior to 7.4.4 are affected. The vulnerability is in the loginok.html page of the web interface.
How do I fix CVE-2025-47813?
Update Wing FTP Server to version 7.4.4 or later. As an additional measure, restrict access to the web administration interface to trusted networks only.
How severe is CVE-2025-47813?
While the CVSS score of 4.3 (MEDIUM) reflects limited direct impact, the EPSS of 21.4% and KEV listing indicate this vulnerability is actively used in attack chains. The disclosed installation path enables attackers to target other, more severe vulnerabilities that require knowledge of absolute file system paths.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.