CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
- State
- Published
- Severity
- 9.8 Critical
- Published
- Apr 22, 2024
- Updated
- Oct 21, 2025
- Reserved
- Apr 22, 2024
Description
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | directcyber |
Weaknesses
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Affected Products
| Product | Versions |
|---|---|
CrushFTPCrushFTP |
|
References
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Updatevendor-advisory
- https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Updatevendor-advisory
- https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/related
- https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/media-coverage
- https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/third-party-advisory
- https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/third-party-advisory
- https://github.com/airbus-cert/CVE-2024-4040exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.