Critical · published July 10, 2025
CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
🚨 A sneaky '' byte in Wing FTP Server can unleash a storm of chaos, enabling attackers to execute arbitrary Lua code at will! 🔥 Think of it like a restaurant that doesn't check for allergens in orders. If a sneaky ingredient slips through, it could spoil the entire meal — or in this case, compromise your server completely! An attacker can swiftly gain root access, executing any command with the server's privileges. This could lead to devastating consequences like data theft, service disruption, or even complete server takeover — absolutely catastrophic!
Think of it like a restaurant that doesn't check for allergens in orders. If a sneaky ingredient slips through, it could spoil the entire meal — or in this case, compromise your server completely! This vulnerability arises from the mishandling of '' bytes in the user and admin web interfaces of Wing FTP Server, allowing injection of malicious Lua code into user session files, which can then run system commands.
An attacker can swiftly gain root access, executing any command with the server's privileges. This could lead to devastating consequences like data theft, service disruption, or even complete server takeover — absolutely catastrophic! Upgrade Wing FTP Server to version 7.4.4 or later immediately. Additionally, consider disabling anonymous FTP accounts to minimize exposure. Regularly audit your server for unusual activity and ensure that access controls are properly configured. You’ve got this! Follow these steps, and you’ll fortify your server against this critical threat. 🛡️