CVE-2025-47813

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-47813
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt Exploit Third Party Advisory
https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ Exploit Third Party Advisory
https://www.wftpserver.com Product
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47813 US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*
History

16 Mar 2026, 20:20

Type Values Removed Values Added
References () https://www.wftpserver.com - Broken Link () https://www.wftpserver.com - Product
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47813 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47813 - US Government Resource

16 Mar 2026, 18:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47813 -

16 Mar 2026, 14:17

Type Values Removed Values Added
References () https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt - Exploit, Third Party Advisory () https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt - Exploit, Third Party Advisory

17 Jul 2025, 13:17

Type Values Removed Values Added
CPE cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*
First Time Wftpserver
Wftpserver wing Ftp Server
References () https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt - () https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt - Exploit, Third Party Advisory
References () https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ - () https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ - Exploit, Third Party Advisory
References () https://www.wftpserver.com - () https://www.wftpserver.com - Broken Link

15 Jul 2025, 13:24

Type Values Removed Values Added
Summary
  • (es) loginok.html en Wing FTP Server anterior a 7.4.4 revela la ruta de instalación local completa de la aplicación cuando se utiliza un valor largo en la cookie UID.

10 Jul 2025, 19:15

Type Values Removed Values Added
References () https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt - () https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt -

10 Jul 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-10 17:15

Updated : 2026-03-16 20:20

NVD link : CVE-2025-47813

Mitre link : CVE-2025-47813

CVE.ORG link : CVE-2025-47813

JSON object : View

Products Affected

wftpserver

  • wing_ftp_server
CWE
CWE-209

Generation of Error Message Containing Sensitive Information