CVE-2025-47813: Wing FTP Server Information Disclosure Flaw

CVE-2025-47813 Overview

CVE-2025-47813 is an information disclosure vulnerability in Wing FTP Server versions prior to 7.4.4. The flaw resides in loginok.html, which reveals the full local installation path of the application when a client submits an unusually long value in the UID cookie. An authenticated attacker can trigger this error-handling condition over the network to recover server-side path information useful for follow-on attacks. The weakness is classified as [CWE-209] (Generation of Error Message Containing Sensitive Information). CISA has added CVE-2025-47813 to its Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation.

Critical Impact
Attackers who recover the full installation path can chain this data with other Wing FTP Server flaws, including the critical RCE tracked as CVE-2025-47812, to improve exploit reliability and target file-system operations.

Affected Products

Wing FTP Server versions prior to 7.4.4
wftpserver:wing_ftp_server (all pre-7.4.4 builds)
Deployments exposing the web administration or client HTTP interface

Discovery Timeline

2025-07-10 - CVE-2025-47813 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47813

Vulnerability Analysis

The vulnerability sits in the login response handler loginok.html inside Wing FTP Server. When the application processes an oversized value in the UID cookie, it enters an error path that embeds the full local installation directory in the response returned to the client. Low-privileged authenticated users can trigger the condition remotely. The disclosed path is sensitive because Wing FTP Server stores configuration, user databases, and Lua session files beneath the installation directory. See the GitHub Advisory for CVE-2025-47813 for the original reporter's writeup.

Root Cause

The root cause is improper error handling in the login flow. Wing FTP Server does not validate the length of the UID cookie before using it in internal processing, and the resulting error message is rendered back to the client without redaction. This matches the [CWE-209] pattern, where diagnostic output intended for operators is surfaced to untrusted callers.

Attack Vector

Exploitation requires network access to the Wing FTP Server HTTP interface and valid credentials. An attacker issues a request to loginok.html with a UID cookie containing an abnormally long string. The server responds with content that includes the absolute installation path. The attacker then uses the recovered path to craft precise payloads for subsequent attacks, including the Lua injection flaw described in the RCE Analysis for CVE-2025-47812.

No verified exploit code is published alongside this advisory; the mechanism is documented in prose by the original researcher.

Detection Methods for CVE-2025-47813

Indicators of Compromise

HTTP requests to /loginok.html carrying a UID cookie whose value exceeds typical session identifier lengths (hundreds or thousands of characters).
Server responses from Wing FTP Server that include absolute local file-system paths in the HTML body.
Clusters of authenticated login attempts followed by requests probing session or configuration file names derived from a disclosed install path.

Detection Strategies

Inspect web server and reverse proxy logs for UID cookie values that deviate from the expected session token length.
Add web application firewall rules that flag or block oversized UID cookies destined for loginok.html.
Correlate information-disclosure attempts with later requests referencing paths beneath the Wing FTP Server install directory.

Monitoring Recommendations

Alert on anomalous response sizes from loginok.html that may contain injected path strings.
Track authenticated accounts that generate repeated malformed login requests, which often precede exploitation of CVE-2025-47812.
Review CISA's Known Exploited Vulnerabilities entry for CVE-2025-47813 for federal reporting and remediation deadlines.

How to Mitigate CVE-2025-47813

Immediate Actions Required

Upgrade Wing FTP Server to version 7.4.4 or later on all exposed hosts.
Rotate credentials for any accounts that could have been used to probe loginok.html prior to patching.
Restrict access to the Wing FTP Server HTTP interface to trusted management networks where possible.
Audit the server for related exploitation of CVE-2025-47812, which shares the same web entry points.

Patch Information

The vendor fixed CVE-2025-47813 in Wing FTP Server 7.4.4. Administrators should download the current release from the WFTPD Server Official Site and follow standard upgrade procedures. Verify after upgrade that loginok.html no longer returns installation paths when supplied with an oversized UID cookie.

Workarounds

Place Wing FTP Server behind a reverse proxy or WAF that strips or rejects UID cookies above a defined length.
Limit HTTP access to the FTP management interface using firewall ACLs until the patch can be deployed.
Disable or restrict unused low-privilege accounts to reduce the authenticated attack surface.

bash

# Example NGINX reverse proxy snippet to reject oversized UID cookies
map $http_cookie $bad_uid_cookie {
    default 0;
    "~*(^|;\s*)UID=[^;]{128,}" 1;
}

server {
    listen 443 ssl;
    server_name ftp.example.com;

    if ($bad_uid_cookie) {
        return 400;
    }

    location / {
        proxy_pass http://127.0.0.1:5466;
    }
}