We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker.
Reserved 2025-03-10 | Published 2025-07-10 | Updated 2025-07-10 | Assigner mitreCWE-15 External Control of System or Configuration Setting
www.wftpserver.com/wftpserver.htm
www.rcesecurity.com/...l-wing-ftp-server-rce-cve-2025-47812/
github.com/...advisories/blob/master/CVEs/CVE-2025-27889.txt
Support options
