How severe is CVE-2025-47812?

CVE-2025-47812 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-47812 being actively exploited?

Yes. CVE-2025-47812 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2025-07-14, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2025-47812?

CVE-2025-47812 affects Wftpserver Wing Ftp Server. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-47812?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2025-47812 have an EU (EUVD) identifier?

Yes. CVE-2025-47812 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-21009. It is also flagged as exploited in the EUVD (since 2025-07-14).

When was CVE-2025-47812 published?

CVE-2025-47812 was published on 2025-07-10 and last updated on 2026-06-17.

CVE-2025-47812

CVE-2025-47812 is a critical-severity vulnerability in Wftpserver Wing Ftp Server with a CVSS 3.x base score of 10.0. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2025-07-14). The underlying weakness is classified as CWE-158.

Key facts

Severity: Critical (CVSS 3.x base score 10.0)
EPSS exploit prediction: 95% (100th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2025-07-14)
EU (EUVD) id: EUVD-2025-21009
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2025-07-14)
Weakness: CWE-158
Affected product: Wftpserver Wing Ftp Server
Published: 2025-07-10
Last modified: 2026-06-17

Description

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

Frequently asked questions

What is CVE-2025-47812?: In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
How severe is CVE-2025-47812?: CVE-2025-47812 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-47812 being actively exploited?: Yes. CVE-2025-47812 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2025-07-14, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2025-47812?: CVE-2025-47812 affects Wftpserver Wing Ftp Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-47812?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2025-47812 have an EU (EUVD) identifier?: Yes. CVE-2025-47812 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-21009. It is also flagged as exploited in the EUVD (since 2025-07-14).
When was CVE-2025-47812 published?: CVE-2025-47812 was published on 2025-07-10 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*

More vulnerabilities in Wftpserver Wing Ftp Server

CVE-2020-37032 — High (CVSS 8.8): Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows…
CVE-2019-25267 — High (CVSS 7.8): Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially…
CVE-2020-9470 — High (CVSS 7.8): An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling…
CVE-2020-8635 — High (CVSS 7.8): Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and…
CVE-2020-8634 — High (CVSS 7.8): Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file…
CVE-2026-44403 — High (CVSS 7.2): Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization…

All CVEs affecting Wftpserver Wing Ftp Server →

Other CWE-158 vulnerabilities

CVE-2025-14388 — Critical (CVSS 9.8): The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all…
CVE-2025-55113 — Critical (CVSS 9.0): If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support…
CVE-2023-5719 — High (CVSS 8.8): The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for…
CVE-2009-1537 — High (CVSS 8.8): Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0…
CVE-2025-9648 — High (CVSS 8.7): A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial…
CVE-2026-33191 — High (CVSS 8.6): Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to…

Browse all CWE-158 vulnerabilities →