CVE-2025-47813

Overview

Actively Exploited. CVE-2025-47813 is an information disclosure vulnerability in Wing FTP Server. The loginok.html endpoint does not properly validate the value of the UID session cookie. When an attacker supplies a cookie value longer than the maximum path size of the underlying operating system, an error message is triggered that discloses the full local server installation path of the application.

While the information disclosure itself is low-severity, this vulnerability is part of a critical exploitation chain alongside CVE-2025-47812 (pre-auth RCE via NULL byte Lua injection) that enables full remote code execution as root (Linux) or NT AUTHORITY\SYSTEM (Windows). This chain is confirmed to be actively exploited in the wild.

Part of a Critical Exploitation Chain

This CVE was discovered during a penetration test by RCE Security researcher Julien Ahrens alongside three other vulnerabilities in Wing FTP Server. Together, they form a critical attack chain:

Chain Impact: An attacker with anonymous FTP access can achieve unauthenticated remote code execution as root/SYSTEM by: (1) leaking the server path via CVE-2025-47813, (2) exploiting a NULL byte authentication bypass in c_CheckUser() to inject Lua code into session files via CVE-2025-47812, and (3) triggering execution of the injected code through any authenticated web endpoint.

Vulnerability Description

The loginok.html endpoint handles authentication for Wing FTP Server's web interface. It reads the UID cookie to manage session state. When this cookie value exceeds the maximum path length of the underlying operating system (e.g., 260 characters on Windows), the application attempts to create or access a session file using the cookie value as part of the file path. This operation fails and triggers an error message that includes the full local installation path of the Wing FTP Server, such as C:\WingFTP\ or /opt/wftpserver/.

The disclosed path information is valuable to attackers because it aids in crafting payloads for CVE-2025-47812, where Lua code is injected into session files stored on the server's filesystem. Knowledge of the exact installation path removes guesswork for file-based attack vectors.

An attacker sends a POST request to /loginok.html with a UID cookie containing an overlong value (hundreds of characters). The server's session file handling concatenates the installation path with the session directory and the UID value, exceeding the OS path limit and causing an unhandled error that leaks the full path.

Affected Products

Wing FTP Server is available for Windows, Linux, and macOS — all platforms are affected.

Remediation

1. Upgrade Wing FTP Server to version 7.4.4 or later.
2. Disable anonymous access if not required — anonymous users can trigger this and the related RCE chain.
3. Restrict web interface access — limit the web client/admin interface to trusted networks via firewall rules.
4. Review server logs for POST requests to /loginok.html with abnormally long UID cookie values.

Detection: Monitor HTTP access logs for requests to /loginok.html with UID cookies exceeding ~260 characters. Check the session/ directory for suspicious session files containing Lua code (indicates CVE-2025-47812 exploitation). Look for NULL bytes (%00) in POST parameters to loginok.html — a signature of the RCE chain.