Wing Ftp Server
CVE-2019-25267
HIGH
Vulnerability Assessment
| Weakness | |
| Impact | CVSS 7.8 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: Low. User interaction: None. Exploitable via local access. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to potentially execute arbitrary code with elevated system privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Wing Ftp Server versions up to 6.0.7 contains a vulnerability that allows attackers to potentially execute arbitrary code with elevated system privileges (CVSS 7.8).
RemediationAI
Monitor vendor advisories for a patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
exists in the the component. Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables that will be launched with LocalSystem permissions.
Know when Wing Ftp Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables that will be launched with LocalSystem permissions.
Executive ViewAI
Wing FTP Server versions up to 6.0.7 contain a critical vulnerability (CVE-2019-25267) that allows attackers to execute arbitrary code with system-level privileges. Organizations running affected versions face immediate risk of complete system compromise, data theft, and lateral network movement. This vulnerability is actively exploited in the wild, making remediation urgent.
Until patching is complete: (1) Restrict FTP access via firewall to trusted IP ranges only; (2) Disable Wing FTP Server if not actively required; (3) Implement network segmentation to isolate FTP servers from critical assets; (4) Enable enhanced logging and real-time monitoring for suspicious authentication and file transfer activity; (5) Enforce strong authentication credentials and consider multi-factor authentication if supported; (6) Deploy WAF/IDS rules to detect exploitation attempts targeting this CVE.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Wing Ftp Server
View allWing FTP Server before 7.4.4 contains a critical remote code execution vulnerability (CVE-2025-47812, CVSS 10.0) through
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a
Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authentica
Authenticated remote code execution in Wing FTP Server 8.1.2 lets a domain administrator inject arbitrary Lua code by ab
An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Rated high severity (CVSS 7.8), this vulnerabilit
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configura
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file ma
Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hij
Authenticated administrators on Wing FTP Server can escape the server's configured base folder by adding user directorie
Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.2.0. Rated high severity (CVSS
Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.2.0. Rated high sever
Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administrat
GitHub PoC