CVE-2024-4040

CrushFTP

Published 22 Apr 2024 · updated 17 Jun 2026 · Analyzed

10.0 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 24 Apr 2024, with a remediation deadline of 1 May 2024 for US federal agencies.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

References

github.com/airbus-cert/CVE-2024-4040 · Exploit, Third Party Advisory
www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/ · Press/Media Coverage, Third Party Advisory
www.crushftp.com/crush10wiki/Wiki.jsp?page=Update · Patch, Vendor Advisory
www.crushftp.com/crush11wiki/Wiki.jsp?page=Update · Patch, Vendor Advisory
www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/ · Third Party Advisory
www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/ · Exploit, Issue Tracking
www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/ · Issue Tracking, Patch
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040 · US Government Resource