CISA flags Wing FTP Server flaw as actively exploited in attacks

CISA warned U.S. government agencies to secure their Wing FTP Server instances against an actively exploited vulnerability that may be chained in remote code execution attacks. Wing FTP Server is a cross-platform FTP server software that also provides secure file transfer via its built-in SFTP and web servers. The developers claim that their file transfer software is used by more than 10,000 customers worldwide, including the U.S. Air Force, Sony, Airbus, Reuters, and Sephora. Tracked as CVE-2025-47813, the security flaw allows threat actors with low privileges to discover the full local installation path of the application on unpatched servers. "Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie," CISA explains. The developer patched it in May 2025 in Wing FTP Server v7.4.4, together with a critical remote code execution (RCE) bug (CVE-2025-47812) and an information disclosure flaw (CVE-2025-27889) that can be used to steal a user's password. The RCE vulnerability was previously tagged as exploited in the wild after attackers began abusing it one day after technical details on the flaw became public. Security researcher Julien Ahrens, who discovered and reported the flaws, also shared proof-of-concept exploit code for CVE-2025-47813 in June and said attackers may exploit it as part of the same chain as CVE-2025-47812. On Tuesday, CISA added CVE-2025-47813 to its catalog of actively ...