CVE-2025-47813: Wing FTP Server Path Disclosure Enables RCE Chain

Medium-Severity Flaw Used to Unlock Critical RCE

CISA added CVE-2025-47813 to its Known Exploited Vulnerabilities (KEV) catalog on March 16, 2026, flagging the flaw as actively exploited in attacks targeting Wing FTP Server deployments worldwide.

Although the vulnerability carries only a CVSS v3.1 score of 4.3 (Medium), its operational significance is far greater: it is the reconnaissance enabler for CVE-2025-47812 (CVSS 10.0 — Critical), a pre-authenticated remote code execution flaw in the same software. Attackers use CVE-2025-47813 to leak the server's installation path, then craft a precise payload for CVE-2025-47812 to achieve unauthenticated RCE with SYSTEM/root privileges.

Federal Civilian Executive Branch (FCEB) agencies must patch by March 30, 2026.

Vulnerability Details

How the Vulnerability Works

The flaw resides in Wing FTP Server's post-authentication handler at /loginok.html. When a POST request is sent to that endpoint with an excessively long value in the UID cookie, the server fails to handle the input gracefully and returns a verbose error message that includes the full local filesystem installation path (e.g., C:\Program Files\WingFTP\...).

The root cause is improper error handling — the server exposes internal path information instead of returning a sanitized error response.

The Two-Step Kill Chain

CVE-2025-47813 is not dangerous in isolation, but serves as the first step in an attacker-documented chain:

Researcher Julien Ahrens documented the full chain in a June 2025 write-up, publishing a working proof-of-concept. Active exploitation began July 1, 2025 — just one day after publication.

Active Exploitation Details

Huntress confirmed real-world exploitation on a customer system, with attacks originating from multiple distinct IP addresses simultaneously. Post-exploitation behavior observed in the wild includes:

• Immediate post-compromise reconnaissance
• Creation of new local user accounts for persistence
• Download and execution of malicious batch files
• Deployment of ScreenConnect (remote monitoring tool) for persistent access

Wing FTP Server has over 10,000 customers worldwide, including US Air Force, Sony, Airbus, Reuters, and Sephora. Approximately 2,000+ internet-facing instances were identified at time of exploitation reports.

Remediation

Patching (Required)

Upgrade to Wing FTP Server v7.4.4 or later, which patches CVE-2025-47813, CVE-2025-47812, and CVE-2025-27889. The patch was released May 14, 2025.

If Patching Is Not Immediately Possible

Per CISA's BOD 22-01 guidance: if mitigations cannot be applied, discontinue use of Wing FTP Server until patching is feasible.

Federal Agencies

FCEB agencies must remediate by March 30, 2026 per CISA's KEV requirements.

Impact Assessment

Recommendations

For System Administrators

1. Upgrade to Wing FTP Server v7.4.4 immediately — both CVEs are patched in this release
2. Inventory all Wing FTP Server instances — include shadow IT deployments that may not appear in official asset lists
3. Restrict internet-facing exposure — place Wing FTP behind a VPN or firewall if external access is not required
4. Review recently created local accounts on Wing FTP hosts for signs of post-exploitation persistence

For Security Teams

1. Hunt for ScreenConnect installations on Wing FTP Server hosts that weren't explicitly authorized
2. Review Wing FTP authentication logs for unusual POST requests to /loginok.html with large cookie values
3. Scan for CVE-2025-47812 and CVE-2025-47813 together — treat both as a single critical-priority remediation item
4. Monitor for null byte patterns in Wing FTP authentication logs (%00 in username fields)

Key Takeaways

1. CVE-2025-47813 is the recon step in a CVSS 10.0 kill chain — its Medium rating understates real-world risk when CVE-2025-47812 is also unpatched
2. Exploitation began July 1, 2025 — organizations still running Wing FTP ≤ 7.4.3 have been at risk for months
3. CISA's KEV addition on March 16, 2026 signals continued active exploitation 8+ months after initial disclosure
4. The patch (v7.4.4) has been available since May 14, 2025 — any organization running an older version is operating a known-exploited system
5. Post-exploitation includes ScreenConnect RAT deployment — treat any compromise as a full incident response event, not just a patching exercise

Sources

• CISA Known Exploited Vulnerabilities Catalog
• BleepingComputer — CISA flags Wing FTP Server flaw as actively exploited in attacks
• RCE Security — CVE-2025-47813 Advisory (Julien Ahrens)
• RCE Security — CVE-2025-47812: What the NULL?! Pre-Auth Wing FTP Server RCE
• Huntress — Wing FTP Server RCE Exploited in the Wild
• NVD — CVE-2025-47813
• NVD — CVE-2025-47812