Crushftp vulnerabilities3 known to be exploited.
Crushftp has 14 published vulnerabilities across 1 product in our catalogue. 3 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Crushftp, with 14. If you run Crushftp software, patch the exploited flaws first.
The most recent Crushftp flaw added to the known-exploited list is CVE-2025-54309, on 22 July 2025. We keep watching the known-exploited list.
Which Crushftp products have the most vulnerabilities?
Crushftp leads with 14 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Crushftp vulnerabilities are being exploited?
3 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.0CrushFTP Unprotected Alternate Channel Vulnerability
CrushFTP contains an unprotected alternate channel vulnerability.
- 9.8CrushFTP Authentication Bypass Vulnerability
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin),...
- 9.8CrushFTP VFS Sandbox Escape Vulnerability
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).
Which Crushftp flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka...
- >99%
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS...
- 95%
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild...
- 94%CVE-2023-48795Medium
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension...
- 82%CVE-2023-43177Critical
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
- 18%CVE-2025-32103Medium
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions.
- 9.4%CVE-2025-32102Medium
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI.
- 1.6%CVE-2017-14035Critical
CrushFTP 8.x before 8.2.0 has a serialization vulnerability.
- 0.7%CVE-2017-14038Medium
CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability.
- 0.7%CVE-2017-14036Medium
CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS.
All Crushftp products we track.
1 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
Running Crushftp? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.
- Matched to
- Crushftp on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 14 published vulnerabilities across 1 product and 66 versions from Crushftp. The most recent Crushftp flaw added to the known-exploited list is CVE-2025-54309, on 22 July 2025.
3 Crushftp vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2025-54309, CVE-2025-31161 and CVE-2024-4040. The full list is on this page.
Crushftp, with 14 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Crushftp products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.