High severity · published Feb 4, 2026
CVE-2019-25267
Wing FTP Server 6.0.7 - Unquoted Service Path
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables that will be launched with LocalSystem permissions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Wing FTP Server · Wftpserver
6.0.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25267
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25267
Exploit
https://www.exploit-db.com/exploits/47818
Third Party Advisory
https://www.vulncheck.com/advisories/wing-ftp-server-unquoted-service-path
Product
https://www.wftpserver.com/
More from Wing FTP Server
10.0
CVE-2025-47812
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
4.3
CVE-2025-47813
Wing FTP Server Information Disclosure Vulnerability
8.8
CVE-2020-37032
Wing FTP Server 6.3.8 - Remote Code Execution
8.8
CVE-2025-27889
Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link
8.8
CVE-2023-37881
Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0