Wing FTP Server Lua Code Injection (CVE-2025-47812)

Historical catalog analysis: CISA added this entry on July 14, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-47812 is a vulnerability in Wing FTP Server involving the improper neutralization of null bytes or NUL characters (CWE-158). This flaw allows for the injection of arbitrary Lua code into user session files. Because the FTP service typically runs with high privileges, successful exploitation could lead to the execution of arbitrary system commands with root or SYSTEM level permissions.

Exposure and applicability

This vulnerability applies to environments deploying Wing FTP Server. The primary exposure path is through the manipulation of user session files via null byte injection. Organizations utilizing this software as a core file transfer mechanism are at risk of full system compromise if an attacker can successfully inject and execute Lua code, given the default high-privilege service account (root/SYSTEM).

Remediation priorities

Based on the inclusion of this vulnerability in CISA’s Known Exploited Vulnerabilities catalog, remediation should be prioritized for all internet-facing and internal instances of Wing FTP Server. Our analysis suggests the following priority sequence:

1. Vendor Mitigation Application: The primary corrective action is to apply mitigations as specified by the vendor. This is the most direct method to address the underlying null byte neutralization failure.
2. Cloud Service Review: For organizations utilizing this software via cloud providers, we recommend reviewing configurations against BOD 22-01 guidance to ensure shared responsibility boundaries are addressed.
3. Decommissioning: In scenarios where vendor mitigations cannot be applied or are unavailable, the product should be discontinued to eliminate the exposure.

How to validate remediation

Verification must go beyond a simple version check, as a version number does not inherently prove that specific mitigation steps were correctly implemented in the environment. To verify that exposure has been reduced, defenders should:

• Confirm Mitigation Deployment: Audit the system against the vendor’s specific implementation instructions to ensure all required changes are active.
• Privilege Review: Verify if the service is still running as root or SYSTEM; while not a fix for the injection itself, reducing the service account privileges could limit the impact of potential execution.
• Configuration Audit: Ensure that session file handling aligns with the updated vendor security baseline.

Limits and open questions

It remains unknown whether this vulnerability has been leveraged in specific ransomware campaigns. Additionally, while applying vendor mitigations reduces the likelihood of exploitation, residual risk may persist if other configuration weaknesses exist within the FTP environment. The effectiveness of these mitigations depends entirely on the accuracy of the vendor’s provided instructions and the completeness of their deployment across all affected nodes.

Source and editorial note

CVE-2025-47812: Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability · Source date: July 14, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: July 17, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 09, 2026 at 00:23 UTC.

Request a Vulnerability Assessment