{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/wftpserver/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2025-47812"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Wing FTP Server (\u003c= 7.4.3)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Wftpserver"],"content_html":"\u003cp\u003eWing FTP Server versions 7.4.3 and earlier are vulnerable to a critical unauthenticated remote code execution (RCE) flaw. The vulnerability exists within the \u003ccode\u003ec_CheckUser()\u003c/code\u003e function, where the username is truncated at the first NULL byte for authentication checks. However, the session creation process writes the full, unsanitized username into a Lua-based session file. By injecting a specially crafted payload containing Lua syntax, an attacker can cause the server to write malicious code into this session file. Accessing any authenticated endpoint subsequently triggers \u003ccode\u003eloadfile()\u003c/code\u003e on the session file, executing the injected Lua code with the privileges of the Wing FTP process (typically SYSTEM on Windows or root on Linux).\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a crafted request to the server containing a NULL byte injected into the username parameter (e.g., \u003ccode\u003eanonymous%00]]\u0026lt;lua\u0026gt;--\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ec_CheckUser()\u003c/code\u003e authentication function truncates the input at the NULL byte, allowing the request to proceed.\u003c/li\u003e\n\u003cli\u003eThe server writes the full, unsanitized username string into a persistent session file.\u003c/li\u003e\n\u003cli\u003eThe malicious Lua payload is successfully stored within the session file.\u003c/li\u003e\n\u003cli\u003eThe attacker requests an authenticated endpoint, such as \u003ccode\u003edir.html\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server loads the session file via \u003ccode\u003eloadfile()\u003c/code\u003e, inadvertently executing the attacker-supplied Lua code.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full system compromise, granting the attacker the same privileges as the Wing FTP Server process, which is often running as root or SYSTEM.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Wing FTP Server to version 7.4.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eInventory all instances of Wing FTP Server in the environment to identify systems running version 7.4.3 or earlier.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for requests containing NULL bytes or suspicious Lua syntax in the username field.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Wing FTP administrative and web interface ports (defaulting to 5466/5467) to authorized networks only.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-30T08:32:29Z","date_published":"2026-10-30T08:32:29Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wing-ftp-rce/","summary":"An unauthenticated remote code execution vulnerability (CVE-2025-47812) in Wing FTP Server \u003c= 7.4.3 allows attackers to execute arbitrary code via Lua injection into session files by leveraging a NULL byte truncation flaw in username handling.","title":"Wing FTP Server: Unauthenticated Lua injection remote code execution (CVE-2025-47812)","url":"https://feed.craftedsignal.io/briefs/2026-10-wing-ftp-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Wftpserver","version":"https://jsonfeed.org/version/1.1"}