Wing FTP Server Information Disclosure Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 16/03/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| wing ftp server | < 7.4.4 | 7.4.4 |
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free