Critical severity · published Apr 22, 2024
CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
In wildKEV
10.0
CVSS
99.5%
EPSS
Yes
On KEV
Description
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)99.5% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Apr 24, 2024
Federal remediation dueMay 1, 2024
Ransomware campaign useNot known
Affected products
Which versions
CR
CrushFTP · CrushFTP
10.0 before 10.7.1; 11.0 before 11.1.0 · source: vendor, NVD, CISA, KEV
In the news
VulnerabilityHigh
Bruteforce Scans for CrushFTP , (Tue, Mar 3rd)
CrushFTP is a Java-based open source file transfer system. It is offered for multiple operating systems. If you run a CrushFTP instance, you may remember that the software has had some serious vulnerabilities: CVE-2024-4040 (the template-injection flaw that let unauthenticated attackers escape the VFS sandbox and achieve RCE), CVE-2025-31161 (the auth-bypass that handed over the crushadmin account on a silver platter), and the July 2025 zero-day CVE-2025-54309 that was actively exploited in the wild. 
Mar 3, 2026·SANS Internet Storm Center
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4040
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4040
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
vendor-advisory
https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update
related
https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/
media-coverage
https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/
third-party-advisory
https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/
third-party-advisory
https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/
More from CrushFTP
9.8
CVE-2025-54309
CrushFTP Unprotected Alternate Channel Vulnerability
9.8
CVE-2025-31161
CrushFTP Authentication Bypass Vulnerability
9.8
CVE-2024-53552
CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover
9.8
CVE-2023-43177
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes
9.8
CVE-2017-14035
CrushFTP 8.x before 8.2.0 has a serialization vulnerability