CVE-2025-47813
Wing FTP Server Information Disclosure Vulnerability
Published Jul 10, 2025 · updated Jun 17, 2026 · Wing FTP Server Wing FTP Server
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
Timeline
Detection, updates, and resolution for this record.
Jul 10, 2025 · Catalog
Detected
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
Mar 16, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Mar 30, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Mar 30, 2026
Affected
- cpe wftpserver/wing ftp serverversion unspecified
- vendor Wing FTP Server Wing FTP Serverversion unspecified
Sources
- CISA KEVCVE-2025-47813
Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie.
cisa.gov - CVE.orgCVE-2025-47813
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-47813
30-day exploitation probability 62.8%
first.org - NIST NVDCVE-2025-47813
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
nvd.nist.gov