Description

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Remediation

References

CVE-2024-4040

Related Vulnerabilities

Liferay DXP Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2025-43827)

EspoCRM Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2025-32390)

Coppermine Multiple Cross-site Scripting (XSS) Vulnerabilities (CVE-2015-6528)

WordPress Plugin Appointment Hour Booking-WordPress Booking Cross-Site Scripting (1.3.15)

Squid Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-3948)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-94 CVE-2024-4040