The US cybersecurity agency CISA on Monday warned that a year-old Wing FTP vulnerability has been exploited in the wild.
A free secure FTP server for Windows, macOS, and Linux, Wing FTP supports multiple file transfer protocols and allows administrators to manage and monitor the server remotely from a web-based interface.
Tracked as CVE-2025-47813, the medium-severity flaw could lead to the disclosure of the full local installation path of the application when a long value is used in the UID cookie of a logged-in session.
The bug was disclosed on May 14, 2025, when Wing FTP Server version 7.4.4 was rolled out with patches for it.
On Monday, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it by March 30.
The security defect impacted Wing FTP’s loginok.html endpoint, which failed to properly validate the UID cookie, allowing an attacker to obtain the full installation path by supplying an overlong value.
“If a value is supplied on this way that is longer than the maximum path size of the underlying operating system, an error message is triggered which discloses the full local server path,” explained Julien Ahrens of RCE Security, who found the bug and published proof-of-concept (PoC) code for it.
According to the security researcher, attackers could leverage the application’s local server path to exploit other vulnerabilities in Wing FTP. One of them is CVE-2025-47812, a critical-severity flaw that leads to remote code execution.
CVE-2025-47812, also patched in Wing FTP Server version 7.4.4, was flagged as exploited in June 2025, when Censys said that roughly 5,000 internet-accessible servers were likely susceptible to exploitation via POST requests. CVE-2025-47812 was added to CISA’s KEV list in July 2025.
Related: In Other News: N8n Flaw Exploited, Slopoly Malware, Interpol Cybercrime Crackdown
Related: Chrome 146 Update Patches Two Exploited Zero-Days
Related: Recent Ivanti Endpoint Manager Flaw Exploited in Attacks
Related: Recent Cisco Catalyst SD-WAN Vulnerability Now Widely Exploited
