CVE-2025-47812

Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

Severity: critical
CVSS v3: 10
EPSS percentile: 100%
Known exploited: yes (CISA KEV)
Vendor: Wing FTP Server
Product: Wing FTP Server
Published: 2025-07-14
Modified: 2026-06-17

Description

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

NVD record

Informational only. Not a warranty of security, completeness or fitness for any purpose. Derived from NVD, CISA KEV, FIRST.org EPSS and vendor advisories (CVE Program List v5); those sources change continuously and may be incomplete or incorrect. Verify every remediation against the vendor advisory before acting. Absence of a finding is not evidence that no vulnerability exists. Not endorsed by NVD, CISA, FIRST or any vendor named.

Raw record

{
  "id": "CVE-2025-47812",
  "title": "Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability",
  "description": "In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.",
  "severity": "critical",
  "cvss": 10,
  "epss": 100,
  "kev": 1,
  "vendor": "Wing FTP Server",
  "product": "Wing FTP Server",
  "published": "2025-07-14",
  "modified": "2026-06-17T09:28:43.200",
  "source": "nvd",
  "remediation": [],
  "disclaimer": "Informational only. Not a warranty of security, completeness or fitness for any purpose. Derived from NVD, CISA KEV, FIRST.org EPSS and vendor advisories (CVE Program List v5); those sources change continuously and may be incomplete or incorrect. Verify every remediation against the vendor advisory before acting. Absence of a finding is not evidence that no vulnerability exists. Not endorsed by NVD, CISA, FIRST or any vendor named."
}