CVE-2025-27889
Published: 10 July 2025
Summary
CVE-2025-27889 is a low-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Wftpserver Wing Ftp Server. Its CVSS base score is 3.4 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement).
Deeper analysis
CVE-2025-27889 affects Wing FTP Server versions prior to 7.4.4, stemming from improper validation and sanitization of the "url" parameter in the downloadpass.html endpoint (CWE-15). This flaw enables attackers to inject arbitrary links into responses. The vulnerability carries a CVSS v3.1 base score of 3.4 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N), rated as low severity due to its reliance on user interaction and limited impact scope.
Exploitation requires no privileges and can occur over the network, but demands high attacker effort and user interaction. An attacker crafts a malicious link targeting the vulnerable endpoint and tricks a legitimate user—such as an administrator—into clicking it. Successful interaction results in the disclosure of a cleartext password to the attacker, potentially enabling further unauthorized access to FTP resources or accounts.
Advisories, including the vendor's site at wftpserver.com and a detailed GitHub advisory, recommend upgrading to Wing FTP Server 7.4.4 or later to mitigate the issue by addressing the parameter validation flaw. No workarounds are specified in available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21019
Vulnerability details
Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-27889 allows arbitrary link injection in a public-facing FTP server web endpoint, facilitating exploitation for credential access via cleartext password disclosure (T1212). The advisory details CVE-2025-47812, enabling pre-auth RCE via NULL byte authentication bypass in the same public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the url parameter on downloadpass.html to block arbitrary link injection.
Enforces information flow rules that would stop the crafted link from exfiltrating the cleartext password to an attacker-controlled destination.
Filters outbound responses from the endpoint so that password data cannot be disclosed via the injected link.