CVE-2025-47813: Wing FTP Server path disclosure via long UID cookie

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe direct impact is only path disclosure (CVSS 4.3), but KEV listing, a 99th-percentile EPSS score and public exploit references indicate real-world exploitation and a likely role in chaining to remote code execution.

What it is

Wing FTP Server before 7.4.4 leaks the full local installation path through loginok.html when a long value is supplied in the UID cookie. The flaw is an error-message information leak (CWE-209) that exposes server filesystem layout to an authenticated user. It matters because path disclosure aids follow-on attacks such as path traversal or file inclusion, and the record is on CISA's KEV catalog with a high EPSS score.

Impact

An attacker with a valid low-privileged account learns the absolute installation path of the FTP server. That knowledge alone does not grant code execution but materially helps chain into other flaws, including the referenced Wing FTP Server RCE.

Attack surface

Reachable over the network through the web interface at loginok.html by sending a crafted long UID cookie; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N). No unauthenticated path is described in the record.

Exploitation

CISA added it to KEV with a due date of 2026-03-30, and EPSS gives a 30-day probability of 0.62967 (99th percentile), indicating active exploitation. Two references are tagged Exploit, though the record does not state whether a public PoC targets this CVE specifically or the related RCE.

What to do

• Upgrade Wing FTP Server to 7.4.4 or later, which the description identifies as the fixed version.
• If upgrade is not possible, restrict access to the web interface and loginok.html to trusted networks and disable unused web features.
• Apply the vendor mitigations referenced in the CISA KEV required action, or discontinue use of the product if no mitigation is available.
• Audit and rotate credentials for any accounts that could reach the web interface, since exploitation requires a low-privileged login.
• Monitor vendor advisories for the related Wing FTP Server RCE (CVE-2025-47812) and patch it alongside this issue.

Detection

• Search web server logs for requests to loginok.html with abnormally long UID cookie values.
• Alert on responses from loginok.html that contain absolute filesystem paths matching the server's installation directory.
• Correlate loginok.html access with subsequent requests for traversal or file-inclusion patterns from the same source.
• Review authentication logs for low-privileged accounts accessing the web interface outside normal patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.