CVE-2025-47813: Wing FTP Server Information Disclosure Vulnerability

Wing FTP Server contains an information disclosure vulnerability, CVE-2025-47813. The flaw belongs to the class of issues where error messages expose sensitive information. It is triggered when the server processes a long value supplied in the UID cookie. This matters for organizations that rely on Wing FTP Server for file transfers, as unintended data leakage can occur during normal error handling.

How it works

The weakness is categorized as CWE-209, generation of error message containing sensitive information. In this product class an attacker supplies an unusually long UID cookie value. The server responds with an error that includes internal details not intended for disclosure.

Technical readers should note that the trigger is tied specifically to cookie handling rather than authentication bypass or command execution. Exact reproduction steps and affected configurations must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

Wing FTP Server instances are typically deployed on Windows or Linux hosts that accept inbound FTP, FTPS, or HTTP-based management connections. Begin by inventorying all servers running this software through asset management tools, service discovery scans, or configuration management databases.

• Locate installations by searching for the Wing FTP Server process or configuration files that reference UID cookie handling.
• Review any exposed management interfaces or proxy configurations that pass cookies to the server.
• Check logs for entries generated during cookie processing; verbose error logging may surface the sensitive data path.
• Confirm specific versions and configurations against the vendor advisory, as public detail is limited.

How to remediate

Apply mitigations per vendor instructions as the primary step. Where the advisory identifies an update, install it on all affected instances before re-enabling external access.

• Disable or restrict features that process the UID cookie if the update cannot be applied immediately.
• Reduce error message verbosity in server configuration to limit information returned to clients.
• Follow applicable BOD 22-01 guidance for any cloud-hosted deployments of the product.

If you can't patch immediately

Until a fix is in place, apply compensating controls that reduce exposure of the affected component. Segment Wing FTP Server hosts so that only trusted networks can reach management or file transfer ports.

• Place the server behind a web application firewall or reverse proxy that can filter or normalize long cookie values.
• Disable the affected cookie-related functionality if the vendor provides that option.
• Increase monitoring of error logs and outbound connections from the server to detect anomalous behavior.
• Consider discontinuing use of the product if mitigations cannot be implemented.

If your data may have been exposed

Actively exploited vulnerabilities lead to breaches. You can run a free exposure scan of your email addresses to check known breach data.