CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2024-04-22
CrushFTP Server-Side Template Injection (SSTI) and Remote Code Execution Vulnerability (CVE-2024-4040) Security Advisory
[Affected Scope] All versions of CrushFTP prior to 10.7.1 and 11.1.0 across all operating system platforms
[Impact] Unauthenticated remote attackers can bypass the VFS Sandbox, read arbitrary files from the filesystem, bypass authentication to gain administrative access, and execute arbitrary code on the server.
[Mitigation] Immediately upgrade CrushFTP to the patched versions (10.7.1 or 11.1.0 or higher) and apply WAF rules to block template injection payloads.