CVE-2025-47811
Quick assessment
Affected
wftpserver Wing FTP Server
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Wing FTP Server是Wing FTP Server开源的一套跨平台的FTP服务器软件。 Wing FTP Server 7.4.4及之前版本存在安全漏洞，该漏洞源于权限管理不当，可能导致权限提升。
Possible ATT&CK Techniques 3 AI
T1548 · Abuse Elevation Control Mechanism T1059 · Command and Scripting Interpreter T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-47811
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands (i.e., through the web console or the task scheduler), and they are automatically executed in the highest possible privilege context. Because administrative users of the web interface are not necessarily also system administrators, one might argue that this is a privilege escalation. (If a privileged application role is not available to an attacker, CVE-2025-47812 can be leveraged.) NOTE: the vendor reportedly considers this behavior "fine to keep."
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权定义了不安全动作
Source: CVE Program / CVE List V5
Vulnerability Title
Wing FTP Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Wing FTP Server是Wing FTP Server开源的一套跨平台的FTP服务器软件。 Wing FTP Server 7.4.4及之前版本存在安全漏洞，该漏洞源于权限管理不当，可能导致权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| wftpserver | Wing FTP Server | 0 ~ 7.4.4 | - |
|
II. Public POCs for CVE-2025-47811
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-47811
请登录查看更多情报信息。
Security Blog Posts for CVE-2025-47811 (1)
Same Patch Batch · wftpserver · 2025-07-10 · 4 CVEs total
| CVE-2025-47812 | 10.0 CRITICAL | Wing FTP Server 7.4.3及 安全漏洞 |
| CVE-2025-47813 | 4.3 MEDIUM | Wing FTP Server 安全漏洞 |
| CVE-2025-27889 | 3.4 LOW | 多款产品安全漏洞 |
IV. Related Vulnerabilities
Same product: Wing FTP Server
Same weakness: CWE-267
-
CVE-2026-96659
Foreman: excessive permissions for viewer role on preview -
CVE-2026-18858
IBM i is Affected By Obtaining Sensitive Information Vulnera -
CVE-2026-81161
Content Moderation Notifications - Moderately critical - Acc -
CVE-2025-36255
DS8900F and DS8A00 Privilege Escalation -
CVE-2026-18951
Odh-training-operator-rhel9: [trainer v2 security] trn-02: r
V. Comments for CVE-2025-47811
No comments yet