Wing FTP Server Remote Code Execution Vulnerability via Null Byte Injection Security Advisory (CVE-2025-47812)
Executive & SecOps Summary
SECOPS ASSESSMENTUser and admin web interfaces of Wing FTP Server before version 7.4.4
Unauthenticated attackers (including anonymous FTP accounts) can inject arbitrary Lua code into session files, leading to remote code execution with root or SYSTEM privileges
Immediately upgrade Wing FTP Server to version 7.4.4 or later, and restrict external access to the web administration interface
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is upgrading Wing FTP Server to version 7.4.4 or higher. For Linux deployments, stop the service and install the latest package using the commands below:
# 1. Stop the running Wing FTP service
sudo /etc/init.d/wftpserver stop
# 2. Download the latest secure version (7.4.4 or later)
wget https://www.wftpserver.com/download/wftpserver-linux-64bit.tar.gz
tar -zxvf wftpserver-linux-64bit.tar.gz
# 3. Run the setup script to apply the upgrade
cd wftpserver
sudo ./setup.sh2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, restrict access to the web administration port (default 5466) using firewall rules, and disable anonymous FTP access to prevent unauthorized exploitation attempts.
# Block external access to the admin port (e.g., 5466) using iptables
sudo iptables -A INPUT -p tcp --dport 5466 ! -s 192.168.1.0/24 -j DROP
# Restrict access using UFW to trusted management subnets only
sudo ufw allow from 10.0.0.0/8 to any port 5466 proto tcp
sudo ufw deny 5466/tcp3. Log Audit & IoC Verification Commands
Inspect the session directories and log files for suspicious null bytes or Lua command injection patterns such as 'os.execute' or 'io.popen'.
# Search for suspicious Lua execution patterns within the session directory
grep -rnw '/opt/wftpserver/session/' -e 'os.execute' -e 'io.popen' 2>/dev/null
# Verify the currently running Wing FTP Server version
strings /opt/wftpserver/wftpserver | grep -i 'Wing FTP Server v' | head -n 1Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-47812) exists in Wing FTP Server due to improper handling of null bytes ('\0') within the user and admin web interfaces. Because the input validation mechanism fails to sanitize or reject null bytes, input strings can be prematurely truncated or bypassed, allowing arbitrary Lua script code to be injected directly into user session files stored on the disk.
2. Exploitation Mechanics & Attack Scenario
An attacker can send a specially crafted payload containing null bytes via the web interface or even through anonymous FTP accounts. When Wing FTP Server serializes and writes session data to disk, the injected Lua payload is saved into the session file. When the server's internal Lua interpreter subsequently parses or loads these session files, the injected Lua code is executed. This allows remote attackers to achieve code execution without valid credentials if anonymous FTP is enabled.
3. Infrastructure & Business Impact
By default, Wing FTP Server runs with high privileges (SYSTEM on Windows, root on Linux). Successful exploitation of this vulnerability guarantees total server compromise, allowing attackers to execute arbitrary system commands, pivot into internal networks, exfiltrate sensitive data, or deploy ransomware. Given its active exploitation in the wild (CISA KEV listed) and an EPSS score exceeding 0.93, this vulnerability poses an immediate and critical threat to enterprise infrastructure.
Official Vendor Advisories & References
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
Frequently Asked SecOps Questions (CVE-2025-47812)
FAQQ1. How critical is CVE-2025-47812 and is it actively exploited in the wild?
CVE-2025-47812 is rated CVSS 10.0 (CRITICAL) with a 30-day EPSS exploitation probability of 93.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-47812?
Primary impacted vendors include wingftp across wing_ftp_server. Scope summary: All Wing FTP Server versions prior to 7.4.4 across all supported platforms (Windows, Linux, etc.)
Q3. What temporary mitigations or workarounds exist for CVE-2025-47812 before patching?
[Mitigation] Immediately upgrade Wing FTP Server to version 7.4.4 or later, and restrict external access to the web administration interface Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-47812
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (wingftp)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.