CVE-2025-27889 Overview
CVE-2025-27889 is a high-severity input validation vulnerability in Wing FTP Server before version 7.4.4. The flaw resides in the downloadpass.html endpoint, which fails to properly validate and sanitize the url parameter. Attackers can inject an arbitrary link into the endpoint, redirecting authenticated users to attacker-controlled destinations. When a user clicks a crafted link, the application discloses a cleartext password to the attacker. The vulnerability maps to [CWE-15] (External Control of System or Configuration Setting) and requires user interaction to succeed. Wing FTP Server is a commercial multi-protocol file transfer server widely deployed in enterprise environments for secure file exchange.
Critical Impact
Successful exploitation discloses cleartext user passwords to remote attackers, enabling account takeover and lateral movement into FTP-accessible infrastructure.
Affected Products
- Wing FTP Server versions prior to 7.4.4
- wftpserver wing_ftp_server (all releases before the fixed version)
- Deployments exposing the downloadpass.html endpoint to untrusted networks
Discovery Timeline
- 2025-07-10 - CVE-2025-27889 published to NVD
- 2025-07-17 - Last updated in NVD database
Technical Details for CVE-2025-27889
Vulnerability Analysis
The vulnerability exists in the downloadpass.html endpoint of Wing FTP Server. This endpoint accepts a url parameter that is intended to direct users to a legitimate download or post-authentication resource. The server fails to validate the contents of this parameter against an allowlist of trusted destinations. Attackers can therefore supply arbitrary external URLs that the server reflects or honors during password handling workflows.
When a victim follows the crafted link, the server transmits the cleartext password as part of the redirected request flow. This exposes the credential to any host the attacker controls. The flaw combines an open redirect pattern with sensitive data leakage in a single request. Network-based exploitation is straightforward and requires only that a victim click a malicious link delivered through phishing or other social channels.
Root Cause
The root cause is missing input validation and output sanitization on the url parameter. The application treats user-supplied URL values as trusted configuration data, violating the [CWE-15] pattern of external control over a security-relevant setting. No allowlist, scheme check, or host comparison restricts where credentials may be sent.
Attack Vector
Exploitation is remote and requires user interaction. An attacker crafts a malicious URL targeting downloadpass.html with a url parameter pointing to an attacker-controlled host. The attacker delivers the link via email, chat, or web content. When an authenticated Wing FTP user clicks the link, the password is transmitted in cleartext to the attacker's endpoint.
The vulnerability mechanism is documented in the public GitHub CVE Advisory and related analysis at RCESecurity. No verified proof-of-concept code is published; refer to the advisory for parameter syntax.
Detection Methods for CVE-2025-27889
Indicators of Compromise
- HTTP requests to /downloadpass.html containing a url query parameter pointing to external or unexpected hosts
- Outbound connections from Wing FTP Server processes to domains not associated with the organization
- Web server access logs showing unusual referer chains terminating at downloadpass.html
- Unexplained authentication events on FTP accounts following user clicks on emailed links
Detection Strategies
- Inspect Wing FTP access logs for downloadpass.html requests where the url parameter contains schemes, hosts, or paths outside the trusted application origin
- Deploy URL filtering rules that flag query parameters carrying fully qualified external URLs to file transfer servers
- Correlate FTP authentication failures and password resets with prior clicks on suspicious links in email gateways
Monitoring Recommendations
- Enable verbose HTTP logging on Wing FTP Server and forward logs to a centralized analytics platform
- Alert on any downloadpass.html request whose url parameter resolves to an external domain
- Monitor for credential reuse patterns across services after Wing FTP user sessions
How to Mitigate CVE-2025-27889
Immediate Actions Required
- Upgrade Wing FTP Server to version 7.4.4 or later as the primary remediation
- Force password resets for all Wing FTP user accounts that may have clicked external links since deployment
- Restrict access to the Wing FTP web interface to trusted networks using firewall or reverse proxy rules
- Notify users about the phishing risk and instruct them to verify URLs before clicking links claiming to originate from the FTP server
Patch Information
The vendor addressed the vulnerability in Wing FTP Server 7.4.4. The fix introduces validation on the url parameter of the downloadpass.html endpoint. Administrators should download the patched release from the Wing FTP Server product page and verify the installed version after upgrade.
Workarounds
- Block external access to the downloadpass.html endpoint at the reverse proxy or web application firewall until patching is complete
- Implement WAF rules that reject requests to downloadpass.html where the url parameter contains an absolute URL or non-relative path
- Disable the password download or recovery feature in Wing FTP configuration if the workflow is not required by the business
# Example nginx rule blocking external URLs in the url parameter
location /downloadpass.html {
if ($arg_url ~* "^(https?:|//)") {
return 403;
}
proxy_pass http://wingftp_backend;
}
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.


