Read the docs
TI-2024-03769 Aliases CVE-2024-4040GHSA-46vf-c8gj-2pgq

Unauthenticated arbitrary file read and remote code execution in CrushFTP

Priority CRITICAL 100Exploited in the wildCWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-1336.

Summary

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Why it matters now

Exploitation Active In CISA KEV since 2024-04-24CISA due date 2024-05-01
EPSS 0.99539 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Fixed CrushFTP (CrushFTP): 10.7.1, 11.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CrushFTPCrushFTP10.0 to before 10.7.1; 11.0 to before 11.1.010.7.1, 11.1.0Patch availableCNA
  • CrushFTP VendorCrushFTP Affected 10.0 to before 10.7.1; 11.0 to before 11.1.0 Fixed in 10.7.1, 11.1.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*10.0.0 to before 10.7.1; 11.0.0 to before 11.1.0VulnerableCrushFTP
  • cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:* Versions 10.0.0 to before 10.7.1; 11.0.0 to before 11.1.0 Vulnerable ·CrushFTP

Remediation

  • Fix · CNA CrushFTP (CrushFTP) Fixed in 10.7.1, 11.1.0

Timeline

  1. 2024-04-24 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2024-4040
  3. 2026-10-03 Alias added: GHSA-46vf-c8gj-2pgq

References

Exploit 2

Patch 3

Advisory 2

  • TI-2025-34136 CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-22407 Authentication bypass in CrushFTP KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-23122 CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of… CVSS 3.1CRITICAL 9.8
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2025-39307 Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. CVSS 3.1MEDIUM 6.1
  • TI-2025-23205 Path traversal in CrushFTP CVSS 3.1MEDIUM 5.0
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences