CVE-2025-47812

The web interfaces of Wing FTP Server's user and administrator panels improperly handle NULL bytes ('\0'). An attacker can exploit this flaw to inject arbitrary Lua code into user session files. The injected Lua code is then executed in the context of the FTP service, allowing execution of arbitrary system commands. Importantly, the vulnerability can be exploited through anonymous FTP accounts — without requiring any authentication credentials.

The attacker gains the ability to execute arbitrary system commands with the privileges of the root user (Linux) or SYSTEM (Windows), resulting in complete server compromise, including access to data, configuration, and further network escalation.

Wing FTP Server must be immediately updated to version 7.4.4 or later. If immediate patching is not possible, consider disabling anonymous FTP access and restricting access to web interfaces at the firewall level. Patch is available from the vendor at www.wftpserver.com.

Wing FTP Server in all versions before 7.4.4 (affects both Linux and Windows installations).

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).