CrushFTP

Vulnerability activity for CrushFTP: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 1
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 1
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 3
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

9.0CriticalJul 18, 2025CrushFTPCVE-2025-54309CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.Added to KEV Jul 22, 2025 · 4 days after publicationExploited93% likelyExploit codeDetection
9.8CriticalApr 3, 2025CrushFTP Auth bypass / access controlCVE-2025-31161CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. Added to KEV Apr 7, 2025 · 4 days after publicationExploited100% likelyExploit codeExploit-DB · NucleiDetection
9.8CriticalApr 22, 2024CrushFTP Code / command injectionCVE-2024-4040CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).Added to KEV Apr 24, 2024 · 1 day after publicationExploited100% likelyExploit codeMetasploit · NucleiDetection

Recent

8.8HighOct 28, 2026CrushFTP CSRFCVE-2015-20129CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.
6.1MediumNov 12, 2025crushftp XSSCVE-2025-63419Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitations leading to HTML Injection.
4.1MediumNov 7, 2025crushftp XSSCVE-2025-63420CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions.
9.0CriticalJul 18, 2025CrushFTPCVE-2025-54309CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.Exploited93% likelyExploit codeDetection
9.8CriticalApr 3, 2025CrushFTP Auth bypass / access controlCVE-2025-31161CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. Exploited100% likelyExploit codeExploit-DB · NucleiDetection
9.8CriticalApr 22, 2024CrushFTP Code / command injectionCVE-2024-4040CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).Exploited100% likelyExploit codeMetasploit · NucleiDetection

See every CrushFTP entry on the dashboard.