---
id: "CVE-2025-47812"
kind: "vulnerability"
aliases: ["CVE-2025-47812"]
title: "wftpserver wing ftp server: In Wing FTP Server before 7.4.4"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Wing FTP Server Wing FTP Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "wftpserver wing ftp server", "fixed": ["7.4.4"], "affected": "< 7.4.4", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "package", "self-hosted", "windows", "wing-ftp-server"]
not_affected_if: ["managed-hosting"]
published_at: "2025-07-10T17:15:47+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47812", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# wftpserver wing ftp server: In Wing FTP Server before 7.4.4

Wing FTP Server fails to strip NUL bytes from input, which lets an attacker inject Lua code into session files. The injected code runs system commands with the FTP service's privileges, root or SYSTEM by default.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Wing FTP Server Wing FTP Server affected ? fixed ?
- vendor:wftpserver wing ftp server affected < 7.4.4 fixed 7.4.4

## Fix

Apply the vendor mitigation or update per Wing FTP Server vendor instructions; the sources do not name a fixed version.
If no mitigation exists, CISA says to discontinue use of the product.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-47812

## From the sources

Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_