Servers and applications
CVE-2025-47813
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 16 Mar 2026.
- Severity
- Medium 4.3
- Published
- 10 Jul 2025
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 7.4.4
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Wing FTP ServerServers and applications · cpe:a:wftpserver:wing_ftp_server |
|
Known exploited
- CISA name
- Wing FTP Server Information Disclosure Vulnerability
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due for US agencies
- 30 Mar 2026
- Used in ransomware
- Not known