ZeroDay Findings
Sign inSign up

Findings

CVE-2025-47812

Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

Published Jul 10, 2025 · updated Jun 17, 2026 · wftpserver wing ftp server

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 10, 2025 · Catalog

    Detected

    In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also explo

  2. Jul 14, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Aug 4, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also explo

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Aug 4, 2025

Affected

  • cpe wftpserver/wing ftp serverversion unspecified
  • vendor Wing FTP Server Wing FTP Serverversion unspecified

Sources

  • CISA KEVCVE-2025-47812

    Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).

    cisa.gov
  • CVE.orgCVE-2025-47812

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-47812

    30-day exploitation probability 93.9%

    first.org
  • Exploit Database52347

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/http/wingftp_null_byte_rce

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesexploit_windows/ftp/wing_ftp_admin_exec

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2025-47812

    In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by de

    nvd.nist.gov

References