Skip to content
OpenAdvisories

Vendor

CrushFTP

7 known vulnerabilities.

CrushFTP at a glance

Last 12 months
1
Critical · all time
4
Exploited · all time
3
Public exploit · all time
3

1 of the exploited vulnerabilities are known to be used by ransomware (CISA).

New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202511
Jun 202500
May 202500
Apr 202531
Mar 202500
Feb 202500
Jan 202500
Dec 202411

Products

CrushFTP 7

Latest advisories

  • High max 8.8
    WID-SEC-2026-4211 1 CVE

    CrushFTP: Schwachstelle ermöglicht Erlangen von Administratorrechten

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in CrushFTP ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Administratorrechte zu erlangen.

    CrushFTP Linux Windows
  • Low max 4.1
    WID-SEC-2025-2530 1 CVE

    CrushFTP: Schwachstelle ermöglicht Cross-Site Scripting

    Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in CrushFTP ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

    CrushFTP Linux Windows
  • High max 9.0
    NCSC-2025-0234 1 CVE 1 exploited rev. 2

    Kwetsbaarheid verholpen in CrushFTP

    CrushFTP heeft een kwetsbaarheid verholpen in versies 10 tot en met 10.8.5 en 11 tot en met 11.3.4_23.

    CrushFTP
    first Jul 21, 2025
  • High max 9.0
    WID-SEC-2025-1608 1 CVE 1 exploited rev. 2

    CrushFTP: Schwachstelle ermöglicht Erlangen von Administratorrechten

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in CrushFTP ausnutzen, um Administratorrechte zu erlangen.

    CrushFTP Linux Windows
    first Jul 20, 2025
  • High max 9.8
    NCSC-2025-0101 1 CVE 1 exploited rev. 2

    Kwetsbaarheid verholpen in CrushFTP

    CrushFTP heeft een kwetsbaarheid verholpen in versies 10.0.0 tot 10.8.3 en 11.0.0 tot 11.3.0.

    CrushFTP
    first Apr 1, 2025
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 8.8
    CVE-2015-20129

    CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

    CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submit…

    CrushFTP CrushFTP
  • Critical 9.0
    CVE-2025-54309 Exploited Public exploit EPSS 93%

    CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation an…

    CrushFTP CrushFTP
    KEV Jul 22, 2025
  • Medium 5.0
    CVE-2025-32102

    CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=…

    CrushFTP CrushFTP
  • Medium 5.0
    CVE-2025-32103 EPSS 18%

    CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/…

    CrushFTP CrushFTP
  • Critical 9.8
    CVE-2025-31161 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unl…

    CrushFTP CrushFTP
    KEV Apr 7, 2025
  • Critical 9.6
    CVE-2024-11986

    Stored XSS in CrushFTP

    Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting…

    CrushFTP CrushFTP
  • Critical 9.8
    CVE-2024-4040 Exploited Public exploit Scanner template EPSS 100%

    Unauthenticated arbitrary file read and remote code execution in CrushFTP

    A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administra…

    CrushFTP CrushFTP
    KEV Apr 24, 2024