CVE-2025-47813

What it actually does

Wing FTP Server versions before 7.4.4 can disclose the server-side installation path when loginok.html processes an unusually long UID cookie value. The flaw is a network-reachable information disclosure issue with low attack complexity; an attacker with the required access context can cause the application to reveal local filesystem path details. While this does not directly grant code execution or modify data, the exposed path can materially assist follow-on exploitation by revealing operating system layout, application install location, and potentially where configuration, logs, certificates, scripts, or backup files may reside.

Why it matters to the business

The immediate impact is leakage of internal server path information from internet-facing file-transfer infrastructure. On its own, the issue is lower severity than remote code execution, but it is listed in CISA KEV and has active in-the-wild exploitation, which raises operational urgency because attackers commonly use path disclosure to improve reliability of chained attacks against externally exposed services. Organizations running affected Wing FTP Server instances may face increased risk of targeted follow-on compromise, data exposure, service disruption, and incident response costs if the server is also affected by other vulnerabilities or weak configuration.

How an attack unfolds

An attacker first identifies an exposed Wing FTP Server instance and reaches the login workflow. Using a valid low-privilege context or otherwise reaching the vulnerable loginok.html endpoint, the attacker sends an HTTP request containing an abnormally long UID cookie value. Vulnerable versions before 7.4.4 mishandle that cookie value and include the full local application installation path in the response or associated error output. The attacker records the disclosed path and uses it to refine later activity, such as targeting known Wing FTP Server file locations, crafting payloads that depend on exact path names, searching for configuration or credential artifacts, or chaining the disclosure with separate authentication, file-write, traversal, or code-execution weaknesses. Because this CVE is in the Known Exploited Vulnerabilities catalog, defenders should treat observed probing of loginok.html with oversized UID cookies as potentially hostile reconnaissance rather than benign scanning.

How to fix it

Upgrade Wing FTP Server to version 7.4.4 or later. The vendor-fixed version referenced for this vulnerability is 7.4.4; any instance running a version before 7.4.4 should be treated as affected. If immediate upgrade is not possible, reduce exposure by restricting access to the Wing FTP Server web interface to trusted networks or VPN, enforcing strong authentication and MFA where supported, placing the service behind a WAF or reverse proxy that blocks oversized UID cookie values, and monitoring for access to loginok.html with abnormal cookie lengths. Do not rely on mitigation alone for KEV-listed systems; schedule the vendor update as the primary fix before the CISA due date of 2026-03-30 where applicable.

How to confirm the fix worked

Confirm the installed Wing FTP Server version is 7.4.4 or later from the administrative console, vendor-provided version output, service metadata, or installed package information. Validate externally that the web interface no longer exposes local filesystem paths when loginok.html receives a long UID cookie value; perform this only in an authorized test window. Review reverse proxy, WAF, and application logs to confirm controls block or alert on oversized UID cookies. For internet-facing assets, repeat discovery scans to ensure no legacy Wing FTP Server instances before 7.4.4 remain exposed.

Typical attack path

1. Discover an internet-accessible Wing FTP Server instance through scanning, banners, certificates, or exposed web login pages.
2. Access the Wing FTP Server web interface and reach the loginok.html endpoint in the required access context.
3. Send a crafted HTTP request to loginok.html containing an unusually long UID cookie value.
4. Observe the HTTP response, application error page, or logged error that reveals the full local installation path.
5. Use the disclosed path to map the host layout and identify likely configuration, log, certificate, script, or upload directories.
6. Chain the information with other weaknesses, stolen credentials, misconfigurations, or known Wing FTP Server attack techniques to attempt deeper compromise.

How to detect it

To determine whether this was already exploited, review Wing FTP Server web access logs, application/error logs, reverse proxy logs, WAF events, and EDR network telemetry for requests to /loginok.html that include a UID cookie with an unusually long value. Focus on internet-sourced requests, repeated probes, 4xx or 5xx responses around loginok.html, and responses with unusually large bodies or error pages. Search application logs and captured HTTP responses for leaked local filesystem paths near loginok.html errors, especially Windows-style paths containing Wing FTP Server installation directories or Unix-style installation paths. Correlate any path-disclosure probes with subsequent activity from the same source IPs, user accounts, sessions, or user agents, including access to administrative pages, configuration-related endpoints, upload/download activity, authentication failures, new account creation, service restarts, or file modifications under the Wing FTP Server installation directory. Because this vulnerability is associated with active exploitation in the wild, treat matches as potential reconnaissance even if no immediate compromise is evident.

• /loginok.html
• GET /loginok.html
• POST /loginok.html
• Cookie: UID=
• loginok.html; Cookie: UID=
• loginok.html" "-"
• loginok.html" 500
• loginok.html" 200
• UID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
• UID=%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41
• Wing FTP Server\\
• C:\\Program Files\\Wing FTP Server\\
• C:\\Program Files (x86)\\Wing FTP Server\\
• /usr/local/wftpserver/
• /opt/wftpserver/
• /Wing FTP Server/Data/
• /wftpserver/Data/

What your security team should do

• Prioritize upgrade of all Wing FTP Server instances to 7.4.4 or later because the vulnerability is KEV-listed and exploitation has been observed in the wild.
• Inventory all externally reachable Wing FTP Server deployments, including disaster recovery, test, and legacy file-transfer servers.
• Search historical web, reverse proxy, WAF, and application logs for requests to loginok.html containing long UID cookie values.
• Treat successful path disclosure as suspicious reconnaissance and investigate for follow-on activity against configuration files, upload paths, administrative endpoints, or other Wing FTP Server vulnerabilities.
• Restrict administrative and web access to trusted source ranges and require MFA or equivalent strong access controls where supported.
• Add WAF or reverse proxy rules to block requests with excessive UID cookie length while upgrade work is completed.
• Preserve relevant logs before rotation, especially for internet-facing servers, because this issue may have been probed well before remediation.
• After patching, run authorized validation tests to ensure crafted UID cookies no longer produce local path disclosure.