CVE-2025-47812 Wing FTP Server Wing FTP Server
Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).
- CVSS
- not scored
On CISA’s exploited list
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
- Added
- 2025-07-14
- Federal patch deadline
- 2025-08-04
- Ransomware use
- not known