/Vulnerability Library

Wing FTP Server <= 7.4.3 - Remote Code Execution

CVE-2025-47812
Verified

Description

Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution (RCE) flaw (CVE-2025-47812). The vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection into session files. These injected session files are executed when accessing authenticated endpoints such as /dir.html, resulting in arbitrary command execution with elevated privileges. This attack is possible only when anonymous login is enabled on the server.

Severity

Critical

CVSS Score

9.8

Exploit Probability

94%

Affected Product

wftpserver

Published Date

July 1, 2025

Template Author

rcesecurity, 4m3rr0r

CVE-2025-47812.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2025-47812

References

https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/https://github.com/4m3rr0r/CVE-2025-47812-poc

Remediation Steps

Upgrade Wing FTP Server to version 7.4.4 or later that properly handles NULL bytes in authentication parameters.