Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server CVE-2025-47812

Name: Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server CVE-2025-47812
Rating: 5 (169 reviews)

2026-02-19 | CVSS 10.0

## https://sploitus.com/exploit?id=E82477B3-6435-5212-9F19-19B64EC7EF9D
# CVE-2025-47812 — Wing FTP Server  Unauthenticated remote code execution vulnerability in Wing FTP Server  whoami
root
```

## References

- [CVE-2025-47812](https://nvd.nist.gov/vuln/detail/CVE-2025-47812)
- [Wing FTP Server 7.4.4 release (fix)](https://www.wftpserver.com/)
- [Original PoC by 4m3rr0r](https://github.com/4m3rr0r)

## Credits

- **Discovery & original exploit:** Sheikh Mohammad Hasan aka [4m3rr0r](https://github.com/4m3rr0r)
- **Cleanup & simplification:** [Esteban Zárate](https://github.com/estebanzarate)