{"id":"CVE-2025-47812","kind":"vulnerability","aliases":["CVE-2025-47812"],"related":[],"title":"wftpserver wing ftp server: In Wing FTP Server before 7.4.4","description":"Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Wing FTP Server fails to strip NUL bytes from input, which lets an attacker inject Lua code into session files. The injected code runs system commands with the FTP service's privileges, root or SYSTEM by default.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2025-07-14T00:00:00+00:00","products":[{"name":"Wing FTP Server Wing FTP Server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"wftpserver wing ftp server","fixed":["7.4.4"],"affected":"< 7.4.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","package","self-hosted","windows","wing-ftp-server"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the vendor mitigation or update per Wing FTP Server vendor instructions; the sources do not name a fixed version.\nIf no mitigation exists, CISA says to discontinue use of the product.","status":"open","published_at":"2025-07-10T17:15:47+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:45+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:46:45Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or update per Wing FTP Server vendor instructions; the sources do not name a fixed version.\nIf no mitigation exists, CISA says to discontinue use of the product.","reach":"internet","summary":"Wing FTP Server fails to strip NUL bytes from input, which lets an attacker inject Lua code into session files. The injected code runs system commands with the FTP service's privileges, root or SYSTEM by default.","category":"package","who_cares":["wing-ftp-server","self-hosted","windows"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary system commands as root or SYSTEM on the server.","analyst_note":"Find the vendor advisory and the fixed version, and confirm affected versions and whether login is needed; start at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000463,"input_tokens":2595,"output_tokens":406,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':133C '-2025':12A,15A '-47812':13A,16A '22':132C '7.4.4':10A 'action':123C 'allow':90C 'appli':124C 'applic':130C 'arbitrari':93C,106C 'attack':50B 'bod':131C 'byte':44B,83C 'charact':86C 'cisa':121C 'cloud':136C 'code':53B,59B,95C 'command':62B,108C 'contain':77C 'cve':11A,14A 'default':73B,120C 'discontinu':139C 'execut':105C 'exploit':27B 'fail':40B 'file':56B,99C 'follow':129C 'ftp':3A,7A,18A,21A,25A,35B,38B,65B,75C,114C 'guidanc':134C 'host':31B 'improp':79C 'inject':51B,58B,91C 'input':46B 'instruct':128C 'let':48B 'lua':52B,94C 'mitig':125C,145C 'neutral':80C 'nul':43B,85C 'null':82C 'packag':28B 'per':126C 'privileg':68B,111C 'product':143C 'requir':122C 'root':69B,116C 'run':60B 'self':30B 'self-host':29B 'server':4A,8A,19A,22A,26A,36B,39B,76C 'servic':66B,115C,137C 'session':55B,98C 'strip':42B 'system':61B,71B,107C,118C 'unavail':147C 'use':103C,140C 'user':97C 'vendor':127C 'vulner':87C 'wftpserver':1A,23A 'window':32B 'wing':2A,6A,17A,20A,24A,34B,37B,74C 'wing-ftp-serv':33B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-07-10T17:15:47+00:00","kev":{"dateAdded":"2025-07-14","dueDate":"2025-08-04","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-47812","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812","severity":null,"published_at":"2025-07-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-47812","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47812","severity":null,"published_at":"2025-07-10T17:15:47+00:00","modified_at":"2026-06-17T09:28:43+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}