EUVD-2025-21009CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5Description
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
Analysis
Wing FTP Server before 7.4.4 contains a critical remote code execution vulnerability (CVE-2025-47812, CVSS 10.0) through null byte injection in user/admin web interfaces that enables arbitrary Lua code execution in session files. With EPSS 92.7% and KEV listing, this vulnerability guarantees unauthenticated root/SYSTEM code execution on affected servers, as the FTP service runs with maximum privileges by default.
Technical Context
Wing FTP Server uses Lua for its scripting engine and stores session data in Lua-format files. The web interfaces fail to reject or properly handle null bytes ('\0') in input, allowing attackers to truncate strings and inject arbitrary Lua code into session files. When the FTP server loads these session files, the Lua interpreter executes the injected code. Since Wing FTP typically runs as root (Linux) or SYSTEM (Windows), this provides maximum-privilege code execution.
Affected Products
['Wing FTP Server before 7.4.4']
Remediation
Upgrade Wing FTP Server to 7.4.4+ immediately. If unable to upgrade, restrict web interface access to trusted IPs. Do NOT run Wing FTP as root/SYSTEM if possible. Audit FTP server for unauthorized access and file modifications.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today