CVE-2024-4040

VendorcrushftpProductcrushftpDiscoveredApr 22, 2024UpdatedFeb 26, 2026

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

View graph Watch Export

CVSS v3.1

9.8 CRITICAL

EPSS

99.5%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Connections

3 relationships

CWE-1336

source

Timeline

disclosure → media coverage

Apr 22, 2024

Disclosure — published as a CVE record. · last revised by NVD Feb 26, 2026

Mar 3, 2026

isc.sans.edu reports: Bruteforce Scans for CrushFTP , (Tue, Mar 3rd)

Public PoC (10)

github.com/airbus-cert/CVE-2024-4040 github.com/rbih-boulanouar/CVE-2024-4040 github.com/Mufti22/CVE-2024-4040 github.com/Stuub/CVE-2024-4040-SSTI-LFI-PoC github.com/0xN7y/CVE-2024-4040 github.com/GraySignal/CVE-2024-4040-CrushFTP-server github.com/dhammerg/CVE-2024-4040 github.com/jakabakos/CVE-2024-4040-CrushFTP-File-Read-vulnerability github.com/gotr00t0day/CVE-2024-4040 github.com/1ncendium/CVE-2024-4040

Unverified third-party code — review before executing.