Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-47813
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过错误消息导致的信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
Wing FTP Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Wing FTP Server是Wing FTP Server开源的一套跨平台的FTP服务器软件。 Wing FTP Server 7.4.4之前版本存在安全漏洞，该漏洞源于loginok.html泄露本地安装路径。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
VendorProductAffected VersionsCPESubscribe
wftpserverWing FTP Server 0 ~ 7.4.4 -
II. Public POCs for CVE-2025-47813
#POC DescriptionSource LinkShenlong Link
1Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability (CVE-2025-47813). The vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an overlong UID value causes the server to respond with an error that includes the full local filesystem path. This can aid in further exploitation (e.g., CVE-2025-47812) by revealing the application’s file system layout. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47813.yamlPOC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC
III. Intelligence Information for CVE-2025-47813
Please Login to view more intelligence information
IV. Related Vulnerabilities
Same product: Wing FTP Server
Same vendor: wftpserver
Same weakness: CWE-209
V. Comments for CVE-2025-47813

No comments yet

Leave a comment