Insecure URL Parameter Vulnerability in Wing FTP Server

CVE-2025-27889

What is CVE-2025-27889?

Wing FTP Server versions before 7.4.4 are susceptible to a vulnerability where the url parameter of the downloadpass.html endpoint is not properly validated or sanitized. This oversight allows attackers to craft a malicious link, which, when clicked by an unsuspecting user, can result in the disclosure of cleartext passwords. Such vulnerabilities can compromise user credentials and pose a significant security risk, necessitating immediate attention and remediation.

References