Wing FTP CVE-2025-47813: Path Leak Joins KEV in 2026

What to do

1. Inventory every Wing FTP Server instance and record its version.
2. Upgrade to the current release (8.2.6 as of Oct 23, 2026), and never leave a server below 7.4.4.
3. Restrict the web client and admin interfaces to trusted networks, and disable anonymous logins unless you need them.
4. If a server ran 7.4.3 or older while internet-facing after June 30, 2025, hunt for CVE-2025-47812 exploitation and rotate its credentials.
5. Rebuild any host where you find injected session files, rogue accounts or remote access tools.

How to check if you are affected or compromised

• Inspect the session folder (Huntress names C:\Program Files (x86)\Wing FTP Server\session) for .lua session files with inflated sizes or embedded commands.
• Search domain logs under Log\Domains for truncated login lines such as User 'anonymous with no closing quote.
• Look for new local accounts named wing or wingftp, and for cmd.exe, PowerShell or certutil launched by the Wing FTP service.
• If your reverse proxy records cookies, look for requests to /loginok.html with very long UID values.

What happened#

On May 14, 2025, Wing FTP Server 7.4.4 fixed a batch of bugs reported by Julien Ahrens of RCE Security. One was CVE-2025-47813. Per the CVE record, loginok.html "discloses the full local installation path of the application when using a long value in the UID cookie." The UID cookie is the web session ID. When it is longer than the operating system's maximum path length, the error message prints the server's install path. The vendor's version history calls it "Full path disclosure through an overlong UID string of a logged-in session." CISA's ADP scores it CVSS 3.1 4.3, and it needs a logged-in session.

The same release fixed a far worse bug, CVE-2025-47812 (CVSS 10.0). A NULL byte in the username lets an attacker inject Lua code into a session file, which then runs as root or SYSTEM. Ahrens published both on June 30, 2025, in a detailed write-up. Huntress saw CVE-2025-47812 exploited on July 1, 2025. CISA added that bug to KEV on July 14, 2025.

CISA added CVE-2025-47813 to the KEV catalog on March 16, 2026, with a March 30 deadline. Ahrens's advisory notes that the leaked path could help attackers exploit other bugs, such as CVE-2025-47812. The Hacker News reported that it is unclear whether attackers are chaining the two. As of Oct 23, 2026, the public evidence behind the listing has not been disclosed.

Who is affected#

Wing FTP Server 7.4.3 and earlier. Version 7.4.4 fixes both bugs. The current release is 8.2.6, dated October 9, 2026. Later releases fixed further issues, including a possible web client RCE for logged-in users in 8.2.5 (September 2026). None of those later bugs is in KEV.

Do you really need to act?#

For most teams, this is not an emergency. A leaked install path helps with recon; it does not hand over the server. The listing matters as a version check. Any server still below 7.4.4 is also open to CVE-2025-47812, which gives code execution as root or SYSTEM and, per its CVE record, works through anonymous accounts too. If a server was internet-facing and unpatched after June 30, 2025, assume it may have been hit and check. Upgrading later does not remove accounts or tools an attacker added.

What to do now#

1. List every Wing FTP Server instance and record its version from the administration interface.
2. Upgrade to the current release (8.2.6 as of Oct 23, 2026). Nothing should remain below 7.4.4.
3. Keep the web client and admin interfaces off the open internet where you can, and disable anonymous logins unless you need them.
4. For any server that ran 7.4.3 or older while exposed after June 30, 2025, run the checks below and rotate every password and key it holds.

How to tell if you were hit#

Huntress calls session files "the best source of truth." On Windows they live in C:\Program Files (x86)\Wing FTP Server\session as .lua files with 64-hex-character names. Unusually large ones deserve a look. In the domain logs under Log\Domains\, a truncated entry such as User 'anonymous with no closing quote and no IP address points to exploitation. Huntress also saw attackers add local accounts named wing and wingftp, download payloads with certutil, and fetch a ScreenConnect installer. Run net user to list local accounts. For the path leak itself, look for /loginok.html requests with very long UID cookies, if your proxy logs cookies.

Timeline#

• May 12, 2025 — Ahrens reports the bugs to Wing FTP.
• May 14, 2025 — Wing FTP Server 7.4.4 fixes CVE-2025-47813 and CVE-2025-47812.
• Jun 30, 2025 — RCE Security publishes full details.
• Jul 1, 2025 — Huntress observes CVE-2025-47812 exploitation.
• Jul 10, 2025 — CVE-2025-47813 is published.
• Jul 14, 2025 — CISA adds CVE-2025-47812 to KEV.
• Mar 16, 2026 — CISA adds CVE-2025-47813 to KEV, due March 30.
• Oct 9, 2026 — Wing FTP Server 8.2.6, the current release, ships.

Vulnerability records

• CVE-2025-47813 · KEV 2026-03-16 · loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Wing FTP Server — Version history (7.4.4 security fixes) wftpserver.com
2. Julien Ahrens (RCE Security) — Advisory: Wing FTP Server CVE-2025-47813 raw.githubusercontent.com
3. RCE Security — What the NULL?! Wing FTP Server RCE (CVE-2025-47812) rcesecurity.com
4. CVE record — CVE-2025-47813 cve.org
5. NVD — CVE-2025-47813 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2025-47813 cisa.gov
7. CVE record — CVE-2025-47812 cve.org
8. Huntress — Wing FTP Server Remote Code Execution (CVE-2025-47812) Exploited in the Wild huntress.com

Coverage and analysis

1. The Hacker News — CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths thehackernews.com