In CISA KEV4.3 MediumCWE-209
CVE-2025-47813
Wing FTP Server Information Disclosure Vulnerability
Status
- Exploited in the wild
- In CISA KEV since 16 Mar
- Fixed in version 7.4.4
Federal deadlineMon 30 Mar, 23:59 UTC
Passed 208 days ago
CISA KEV · added 16 Mar
Exploit probabilityEPSSchecked 24 Oct
63%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
SeverityCVSS
4.3Medium
Description NVD
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 6 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 16 Mar · 18:49 UTC | CISA | CISA Adds CVE-2025-47813 to Known Exploited Vulnerabilities Catalogue |
| Mon 16 Mar · 18:52 UTC | CISA | CISA Adds One Known Exploited Vulnerability to Catalog |
| Mon 16 Mar · 21:11 UTC | CISA | CISA Adds CVE-2025-47813 to Known Exploited Vulnerabilities Catalogue |
| Mon 16 Mar · 21:54 UTC | Security Affairs | U.S. CISA adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog |
| Tue 17 Mar · 06:01 UTC | The Hacker News | CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths |
| Tue 17 Mar · 11:07 UTC | SecurityWeek | CISA Flags Year-Old Wing FTP Vulnerability as Exploited |
- CISA Flags Year-Old Wing FTP Vulnerability as ExploitedSecurityWeek
- CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server PathsThe Hacker News
- U.S. CISA adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalogSecurity Affairs
- CISA Adds CVE-2025-47813 to Known Exploited Vulnerabilities CatalogueCISA · official notice
- CISA Adds One Known Exploited Vulnerability to CatalogCISA · official notice
- CISA Adds CVE-2025-47813 to Known Exploited Vulnerabilities CatalogueCISA · first in our coverage · official notice