Privilege Escalation in Wing FTP Server by Frustrated User
CVE-2025-47811
What is CVE-2025-47811?
In Wing FTP Server versions up to 7.4.4, a significant vulnerability exists within the administrative web interface, which operates under the root or SYSTEM user by default. This issue allows authenticated users to execute arbitrary system commands through legitimate features of the web application, such as the web console and task scheduler. Administrative users, who may not hold system administration privileges, can inadvertently escalate their privileges. The vendor has indicated that this behavior is acceptable, raising concerns about the potential exploitation of this vulnerability.
Affected Version(s)
Wing FTP Server 0 <= 7.4.4
News Articles
Hackers are exploiting critical RCE flaw in Wing FTP Server
Hackers have started to exploit a critical remote code execution vulnerability in Wing FTP Server just one day after technical details on the flaw became public.
4 weeks ago
Critical Zero-Day Vulnerability Grants Root Access to Wing FTP Servers Worldwide
A critical null-byte injection vulnerability in Wing FTP Server has been discovered that allows attackers to gain complete root access to affected systems, potentially compromising thousands of file transfer...