CVE-2025-47811: wftpserver Wing FTP Server · Privilege Defined With Unsafe Actions
Affects wftpserver Wing FTP ServerSource CVE Database V5
Mentioned vulnerabilities
Not known to be exploited · CVSS 4.1 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 6.1% chance of exploitation in 30 days – higher than 93% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 10 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| wftpserver Wing FTP Server | Affected
| Fixed in– |
AI-suggested
Since no patches are currently available, European organizations should implement the following specific mitigations: 1) Restrict network access to the Wing FTP Server administrative interface by limiting exposure to trusted management networks only, using firewalls and network segmentation. 2) Enforce strong authentication mechanisms for administrative users, including multi-factor authentication (MFA), to reduce the risk of credential compromise. 3) Regularly audit administrative user accounts and privileges to ensure only necessary personnel have access. 4) Monitor and log all administrative interface activities, especially command executions, to detect suspicious behavior promptly. 5) Consider running the Wing FTP Server administrative interface under a less privileged user context if possible, or isolate the server in a hardened environment to limit potential damage. 6) Evaluate alternative FTP server solutions with more secure privilege separation if risk tolerance is low. 7) Stay alert for updates or patches from the vendor or third-party security advisories addressing this vulnerability. 8) Implement intrusion detection/prevention systems (IDS/IPS) to detect exploitation attempts targeting the administrative interface.
Description
In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands (i.e., through the web console or the task scheduler), and they are automatically executed in the highest possible privilege context. Because administrative users of the web interface are not necessarily also system administrators, one might argue that this is a privilege escalation. (If a privileged application role is not available to an attacker, CVE-2025-47812 can be leveraged.) NOTE: the vendor reportedly considers this behavior "fine to keep."