Login Request a demo
High severity · published Oct 28, 2026
CVE-2015-20129
CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/
New
8.8
CVSS
–
EPSS
No
On KEV
Description
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
CrushFTP · CrushFTP
before 7.3.0 · source: vendor
Affected product
CR
CrushFTP
CrushFTP
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-20129
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-20129
exploit
https://www.exploit-db.com/exploits/36126
release-notes
https://www.crushftp.com/version7.html
third-party-advisory
https://www.vulncheck.com/advisories/crushftp-before-7.3.0-cross-site-request-forgery-via-webinterface-function
More from CrushFTP
10.0
CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
9.8
CVE-2025-54309
CrushFTP Unprotected Alternate Channel Vulnerability
9.8
CVE-2025-31161
CrushFTP Authentication Bypass Vulnerability
9.8
CVE-2024-53552
CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover
9.8
CVE-2023-43177
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes