CISA Adds Wing FTP Vulnerability to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency added a vulnerability in Wing FTP Server software to its Known Exploited Vulnerabilities catalog on Monday, citing evidence of active exploitation by threat actors. The flaw, tracked as CVE-2025-47813, allows attackers to disclose the application's full local installation path on affected servers.

Wing FTP Server is a cross-platform tool used to set up secure file transfer protocols, including FTP, FTPS, HTTP, HTTPS, and SFTP. It supports large-scale data management and remote server control, with customers spanning industries such as defense, media, and retail. The vulnerability affects all versions prior to 7.4.4 and carries a CVSS score of 4.3, classifying it as medium severity.

According to agency details, the issue arises during the web authentication process on the loginok.html endpoint. An attacker can send an excessively long value in the UID session cookie, which triggers improper input handling. This causes the server to generate an error message revealing sensitive filesystem information, including the complete local path of the installation. While the flaw itself does not enable direct remote code execution,...