Read the docs

CrushFTP

Records19All Threatist records
Exploited (KEV)3In CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

CrushFTP records in CISA KEV
TI-2025-34136 CrushFTP Unprotected Alternate Channel Vulnerability Priority CRITICAL 100KEV 2025-07-22TI-2025-22407 CrushFTP Authentication Bypass Vulnerability Priority CRITICAL 100KEV 2025-04-07TI-2024-03769 CrushFTP VFS Sandbox Escape Vulnerability Priority CRITICAL 100KEV 2024-04-24

Components

Products in the NVD configurations · select one to filter the records
Crushftp 17 records CRITICAL

Records

17 records in Crushftp · all components

TI-2025-34136 CVE-2025-54309 · GHSA-rh5q-v9ww-rqgm

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not…

Priority CRITICAL 100KEV

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.93473 Published 2025-07-18 Fixed in 10.8.5, 11.3.4_23 CWE-420
TI-2025-22407 CVE-2025-31161 · GHSA-c57h-rx24-vf52

Authentication bypass in CrushFTP

Priority CRITICAL 100KEV

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthentic…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99969 Published 2025-04-03 Fixed in 10.8.4, 11.3.1 CWE-305
TI-2024-03769 CVE-2024-4040 · GHSA-46vf-c8gj-2pgq

Unauthenticated arbitrary file read and remote code execution in CrushFTP

Priority CRITICAL 100KEV

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, b…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99539 Published 2024-04-22 Fixed in 10.7.1, 11.1.0 CWE-1336
TI-2023-26623 CVE-2023-48795 · GHSA-45x7-px36-x8w8

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6…

Priority HIGH 70

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.93547 Published 2023-12-18 Partial fix · 0.40.2, 0.17.0 +2 CWE-354
TI-2025-23205 CVE-2025-32103 · GHSA-94cq-g9vr-5q43

Path traversal in CrushFTP

Priority MEDIUM 56

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.18093 Published 2025-04-15 No fix listed CWE-40
TI-2025-23204 CVE-2025-32102 · GHSA-4p7q-hmcp-j657

Server-side request forgery in CrushFTP

Priority MEDIUM 56

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.09411 Published 2025-04-15 No fix listed CWE-918
TI-2021-19807 CVE-2021-44076 · GHSA-pq5g-2f3q-7fq7

An issue was discovered in CrushFTP 9.

Priority LOW 23

An issue was discovered in CrushFTP 9.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00683 Published 2022-09-15 No fix listed CWE-79
Open these records in search →