Description

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions.

Remediation

References

CVE-2025-32103

Related Vulnerabilities

WordPress Plugin CP Contact Form with PayPal Cross-Site Scripting (1.2.97)

WordPress Plugin WP DSGVO Tools (GDPR) Security Bypass (3.1.23)

phpList Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-20029)

WordPress Plugin Yes-co ORES Cross-Site Scripting (1.3.44)

WordPress Improper Input Validation Vulnerability (CVE-2014-9038)

Severity

Medium

Classification

CVE-2025-32103 CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities