CVE-2025-27889 | wftpserver Wing FTP Server up to 7.4.3 Parameter downloadpass.html url external control of system or configuration setting

A vulnerability classified as problematic was found in wftpserver Wing FTP Server up to 7.4.3. This vulnerability affects unknown code of the file downloadpass.html of the component Parameter Handler. The manipulation of the argument url leads to external control of system or configuration setting.

This vulnerability was named CVE-2025-27889. The attack can be initiated remotely. There is no exploit available.

It is recommended to upgrade the affected component.