Wing FTP Server Information Disclosure Vulnerability (CVE-2025-47813) - Full Installation Path Leakage Advisory

1. Apply Official Security Patch

Upgrade your Wing FTP Server instance to version 7.4.4 or higher immediately by downloading the latest installer from the official vendor website.

2. Temporary Mitigation via WAF / Reverse Proxy

If immediate patching is not feasible, configure your Web Application Firewall (WAF) or reverse proxy to block requests containing excessively long UID cookies.

Nginx Configuration Example:

# Block requests where the UID cookie exceeds a reasonable length (e.g., 128 characters)
if ($http_cookie ~* "UID=[a-zA-Z0-9]{129,}") {
    return 400 "Bad Request: Invalid Session Identifier";
}

Snort / Suricata IDS Rule:

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"EXPLOIT Wing FTP Server CVE-2025-47813 Long UID Cookie"; flow:established,to_server; content:"Cookie|3a|"; http_header; content:"UID="; http_header; pcre:"/UID=[a-zA-Z0-9]{128,}/H"; sid:1000001; rev:1;)

This vulnerability (CVE-2025-47813) is classified under CWE-209 (Generation of Error Message Containing Sensitive Information) within the loginok.html component of Wing FTP Server.

When an attacker transmits an HTTP request containing an abnormally long string in the UID cookie, the backend application fails to handle the input gracefully. Instead of suppressing internal system details, the server returns an error response that explicitly leaks the absolute physical installation path of the application on the host operating system.

Although assigned a CVSS base score of 4.3 (Medium), this vulnerability is highly critical as it has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Attackers actively leverage this local path disclosure to construct precise payloads for secondary exploits, such as local file inclusion or remote code execution.