What is the CVSS score of CVE-2025-47812?

CVE-2025-47812 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 92.7%.

Which versions of Ftp are affected by CVE-2025-47812?

Wing FTP Server versions prior to 7.4.4 contain a critical unauthenticated remote code execution vulnerability (CVSS 10.0) that is actively being exploited in the wild.. A patch is available.

Is there a public PoC exploit available for CVE-2025-47812?

Yes, a public proof-of-concept exploit is available for CVE-2025-47812. Prioritise patching immediately. EPSS: 92.7%.

How to fix or mitigate CVE-2025-47812?

Within 24 hours: Identify all Wing FTP Server instances in your environment and document current versions. Within 7 days: Upgrade all Wing FTP Server installations to version 7.4.4 or later; if immediate patching is impossible, isolate affected servers from untrusted networks and restrict web interface access to known administrator IP ranges only. Within 30 days: Conduct forensic review of FTP server logs and session files for indicators of exploitation, verify integrity of transferred files, and implement network segmentation to limit FTP server exposure.

Ftp CVE-2025-47812

EUVD-2025-21009 CRITICAL

Improper Neutralization of Null Byte or NUL Character (CWE-158)

2025-07-10 cve@mitre.org

RCE Code Injection Ftp Privilege Escalation Wing Ftp Server

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:51 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.4.4

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21009

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

Added to CISA KEV

Nov 05, 2025 - 19:26 cisa

CISA KEV

PoC Detected

Nov 05, 2025 - 19:26 vuln.today

Public exploit code

CVE Published

Jul 10, 2025 - 17:15 nvd

CRITICAL 10.0

DescriptionCVE.org

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

AnalysisAI

Wing FTP Server before 7.4.4 contains a critical remote code execution vulnerability (CVE-2025-47812, CVSS 10.0) through null byte injection in user/admin web interfaces that enables arbitrary Lua code execution in session files. With EPSS 92.7% and KEV listing, this vulnerability guarantees unauthenticated root/SYSTEM code execution on affected servers, as the FTP service runs with maximum privileges by default.

Technical ContextAI

Wing FTP Server uses Lua for its scripting engine and stores session data in Lua-format files. The web interfaces fail to reject or properly handle null bytes ('\0') in input, allowing attackers to truncate strings and inject arbitrary Lua code into session files. When the FTP server loads these session files, the Lua interpreter executes the injected code. Since Wing FTP typically runs as root (Linux) or SYSTEM (Windows), this provides maximum-privilege code execution.

RemediationAI

Upgrade Wing FTP Server to 7.4.4+ immediately. If unable to upgrade, restrict web interface access to trusted IPs. Do NOT run Wing FTP as root/SYSTEM if possible. Audit FTP server for unauthorized access and file modifications.