CVE-2025-47813KEV · OVERDUECWE-209

Wing FTP Server Information Disclosure Vulnerability

Medium · published July 10, 2025

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 4.3. It is confirmed in active exploitation. It sits in the 99.2th percentile for exploit probability.

208
days past CISA
deadline
CVSS v3.1
4.3
EPSS
63%
Percentile
99.2
In the wild
Confirmed
What it is

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.62512 · 99.2th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2025-07-10T00:00Z
KEV added
2026-03-16 · due 2026-03-30
EPSS history
Timeline
  • 16 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 30
    kev
  • 10 JUL 00:00Z
    loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie
    cvelistv5