https://blog.msnieman.com/tags/cve-2025-4138/Recent content in CVE-2025-4138 on Myles Nieman — BlogHugoen-usTue, 17 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/wingdata/Tue, 17 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/wingdata/Wing FTP Server 7.4.3 exposes an unauthenticated RCE endpoint; cracking the salted password hashes from its XML config yields SSH access as a system user, and a root-owned backup script extracting untrusted zip archives is exploited via CVE-2025-4138 (Python zipslip) for privilege escalation.