CVE-2025-5196 | Wing FTP Server up to 7.4.3 Lua Admin Console unnecessary privileges

A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Lua Admin Console. The manipulation leads to execution with unnecessary privileges.

This vulnerability is known as CVE-2025-5196. The attack can be launched remotely. There is no exploit available.

It is recommended to upgrade the affected component.

The vendor explains: “[W]e do not consider it as a security vulnerability, because the system admin in WingFTP has full permissions […], but you can suggest the user run WingFTP service as Normal User rather than SYSTEM/Root, it will be safer.”