PRP: Wing FTP Server CVE-2025-47812 RCE #707
Description
- Identifier of the vulnerability:
CVE-2025-47812 - Affected software: Wing FTP Server ≤ 7.4.3 (patched in 7.4.4)
- Type of vulnerability: Remote Code Execution (RCE) — NULL-byte truncation combined with Lua code injection into session files (user input is truncated for authentication checks but the full input gets written to a session/Lua context and executed).
- Requires authentication: No (exploitable without valid auth; unauthenticated access can be sufficient)
- Language you would use for writing the plugin: templated plugin format
- Resources:
https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild