NewsCompaniesFlawsGuides
Get the app
MediumFixedBeing used in attacksClosedUpdated

Wing FTP Server installation-path leak CVE-2025-47813 used in attacks; fixed in 7.4.4

Attackers are exploiting a flaw in Wing FTP Server before 7.4.4 that reveals where the software is installed to a logged-in user. The fix has been available since May 2025. Ask the administrator to update to a current release.

What to do

If your business or family office runs Wing FTP Server, ask its administrator to update to a current vendor release; 7.4.4 is the first version that fixes this flaw. If you only use someone else's file-transfer service, its operator must apply the update.

What’s happening

CVE-2025-47813 affects Wing FTP Server, software organisations use to transfer files on Windows, Linux and Mac. An attacker with a logged-in account can cause the web interface to reveal the full folder path where the application is installed. Wing FTP fixed the disclosure in version 7.4.4 on 14 May 2025. On 16 March 2026, CISA listed the flaw as exploited in real attacks. The disclosure itself exposes an internal path; it does not establish that files or passwords were stolen. The reviewed reports do not identify victims or when exploitation began. As at 3 November 2026, no later change to the fix or confirmation that attacks have ended was found.

What
Flaw
Affects
Wing FTP Server
Affected
Wing FTP Server versions before 7.4.4
Fixed in
Wing FTP Server 7.4.4
CVE
CVE-2025-47813
Since
16 Mar 2026
Closed
18 Mar 2026

Timeline

  1. Update

    CERT-In warned that authenticated attackers could obtain the server's local installation path on versions before 7.4.4 and recommended applying the vendor's update.

  2. CISA added

    CISA added CVE-2025-47813 to its Known Exploited Vulnerabilities catalogue. Canada's Cyber Centre updated its advisory to highlight the listing and urged administrators to apply updates.

  3. Made public

    MITRE published the CVE-2025-47813 record, identifying versions before 7.4.4 as affected and rating the flaw medium, with a CVSS score of 4.3.

  4. New fixFixed

    Wing FTP released Server 7.4.4, fixing a flaw that exposed the installation path through a logged-in session.

Sources

  1. Wing FTP Server Release Notes — version 7.4.4Wing FTP · 14 May 2025
  2. CVE Record: CVE-2025-47813MITRE · 10 July 2025
  3. Wing FTP security advisory (AV25-391) — Update 2Canadian Centre for Cyber Security · 16 Mar 2026
  4. Information Disclosure Vulnerability in Wing FTP Server — CIVN-2026-0144CERT-In · 18 Mar 2026
  5. CISA flags Wing FTP Server flaw as actively exploited in attacksBleepingComputer · 16 Mar 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from March 2026 · JSON · RSS