Vulnerabilities - CISA Adds Wing FTP Server Flaw Alert

The Flaw

CISA has recently added a significant vulnerability to its Known Exploited Vulnerabilities catalog. This flaw, tracked as CVE-2025-47813, affects Wing FTP Server versions prior to 7.4.4. The vulnerability is categorized as an information disclosure issue, which means it can leak sensitive information without allowing direct exploitation.

The flaw occurs in the loginok.html page during the web authentication process. When an attacker sends an excessively long UID cookie, it triggers improper input handling. This results in the server revealing the full local installation path of the application, which could be used for further attacks.

What's at Risk

While this vulnerability does not allow for remote code execution, it poses a risk by leaking filesystem details. Such information can be invaluable for attackers, enabling them to conduct reconnaissance. They could potentially exploit this information for path-based attacks or file inclusion attempts, which could compromise the server further.

The CVSS score of 4.3 indicates a medium severity level, highlighting the importance of addressing this flaw promptly. Organizations using affected versions of Wing FTP Server should take immediate action to mitigate risks associated with this vulnerability.

Patch Status

CISA has mandated that federal agencies must address this vulnerability by March 30, 2026. This directive is part of the Binding Operational Directive (BOD) 22-01, which aims to reduce the risk of known exploited vulnerabilities. Private organizations are also encouraged to review the catalog and take necessary actions to secure their infrastructures.

The latest version of Wing FTP Server, 7.4.4, includes a fix for this vulnerability. It is crucial for organizations to update their systems to this version to prevent potential exploitation.

Immediate Actions

Organizations should prioritize the following actions:

• Update Wing FTP Server to version 7.4.4 or later.
• Review security practices to ensure that sensitive information is not exposed through improper input handling.
• Monitor systems for any signs of exploitation attempts related to this vulnerability.

By taking these steps, organizations can significantly reduce their risk of falling victim to further attacks that leverage this information disclosure flaw.