Wing FTP Vulnerability CVE-2025-47813 - CISA Alerts Exploitation
Basically, a flaw in Wing FTP can let attackers see secret paths on the server.
CISA has flagged a year-old vulnerability in Wing FTP as actively exploited. This flaw could expose sensitive installation paths, increasing security risks. Immediate patching is essential to protect your systems.
The Flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a year-old vulnerability in Wing FTP, tracked as CVE-2025-47813. This medium-severity flaw arises when an overly long value is used in the UID cookie during a logged-in session. When exploited, it can disclose the full local installation path of the application, posing a significant security risk.
Wing FTP is a popular secure FTP server that operates across multiple platforms, including Windows, macOS, and Linux. The vulnerability affects the loginok.html endpoint, which fails to validate the UID cookie properly. As a result, attackers can manipulate the UID cookie to trigger an error message that reveals sensitive information about the server's installation path.
What's at Risk
The implications of this vulnerability are serious. By obtaining the full local server path, attackers can potentially exploit other vulnerabilities within Wing FTP. Notably, CVE-2025-47812, another critical flaw that allows remote code execution, could be leveraged once the installation path is known. This interconnectedness amplifies the risk, making it crucial for organizations using Wing FTP to take immediate action.
The flaw was first disclosed on May 14, 2025, coinciding with the release of Wing FTP Server version 7.4.4, which included patches for this vulnerability. However, the recent CISA alert indicates that the flaw is now being actively exploited in the wild, highlighting the importance of timely patching.
Patch Status
CISA has added CVE-2025-47813 to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies are urged to apply the necessary patches by March 30, 2026. Organizations that have not yet updated their systems are at risk of exploitation, especially since the vulnerability has been confirmed to be actively targeted.
The patch for this vulnerability is included in the same version that addressed CVE-2025-47812. Thus, it is essential for users to ensure they are running the latest version of Wing FTP to mitigate these risks effectively.
Immediate Actions
For those managing Wing FTP servers, immediate action is necessary. Here are steps to take:
- Update to the latest version of Wing FTP Server (7.4.4 or later) to apply the patches.
- Review server logs for any suspicious activity that may indicate exploitation attempts.
- Implement additional security measures, such as limiting access to the server and monitoring for unusual behavior.
By taking these steps, organizations can protect themselves from potential attacks stemming from this vulnerability. The time to act is now, as the risk of exploitation continues to grow.
SecurityWeek