CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
| CWE | CWE-1336 |
| Vendor | crushftp |
| Product | crushftp |
| Published | Apr 22, 2024 |
| Last Updated | Oct 21, 2025 |
⚠️ Actively Exploited — Act Now
Get instant alerts for crushftp crushftp
This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2024-4040.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
CrushFTP / CrushFTP
10.0 < 10.7.1 11.0 < 11.1.0
References
crushftp.com: https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update crushftp.com: https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update reddit.com: https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/ bleepingcomputer.com: https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/ reddit.com: https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/ rapid7.com: https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/ github.com: https://github.com/airbus-cert/CVE-2024-4040 cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040
Credits
🔍 Simon Garrelou, of Airbus CERT