Back to CVE Browser

CVE-2024-4040

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2024-04-22

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Affected Platforms (CPE)

📦

Crushftp

Crushftp

>= 10.0.0 and < 10.7.1>= 11.0.0 and < 11.1.0

References & Advisories

🔗 https://github.com/airbus-cert/CVE-2024-4040

🔗 https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/

🔗 https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update

🔗 https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update

🔗 https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/

🔗 https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/

🔗 https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/

🔗 https://github.com/airbus-cert/CVE-2024-4040

Related Vulnerabilities

CVE-2025-634196.1

Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, th...

CVE-2025-634204.1

CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), e...

CVE-2025-543099.0

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequen...

CVE-2025-321035.0

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to rea...