SecurityWeekIonut Arghire
CISA Flags Year-Old Wing FTP Vulnerability as Exploited
According to CISA, a year-old Wing FTP vulnerability has been exploited in the wild, tracked as CVE-2025-47813, which could disclose the full local installation path of the application when a long value is used in the UID cookie of a logged-in session. The flaw affects Wing FTP Server and was disclosed on 14 May 2025, when version 7.4.4 shipped patches. The issue lies in the loginok.html endpoint, where improper UID cookie validation allows an overlong value to reveal the server’s full installation path.
Julien Ahrens of RCE Security, who found the bug and published PoC code, explained that an attacker could use the disclosed path to exploit other vulnerabilities in Wing FTP, including CVE-2025-47812, a related critical flaw patched in 7.4.4 and flagged as exploited in June 2025, with Censys estimating about 5,000 internet‑accessible servers likely susceptible via POST requests. CISA added CVE-2025-47813 to its Known Exploited Vulnerabilities catalog and urged federal agencies to patch by 30 March.
Story timeline CVE-2025-47813
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 16 Mar · 18:49 UTC | CISA | CISA Adds CVE-2025-47813 to Known Exploited Vulnerabilities Catalogue |
| Mon 16 Mar · 18:52 UTC | CISA | CISA Adds One Known Exploited Vulnerability to Catalog |
| Mon 16 Mar · 21:11 UTC | CISA | CISA Adds CVE-2025-47813 to Known Exploited Vulnerabilities Catalogue |
| Mon 16 Mar · 21:54 UTC | Security Affairs | U.S. CISA adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog |
| Tue 17 Mar · 06:01 UTC | The Hacker News | CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths |
| Tue 17 Mar · 11:07 UTC | SecurityWeek | CISA Flags Year-Old Wing FTP Vulnerability as Exploited (this article) |