CVE-2024-4040: CrushFTP VFS Sandbox Escape Vulnerability

Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2024-04-24. EPSS: 99.5% chance of exploitation in the next 30 days.

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Affected products

• CrushFTP CrushFTP: from 10.0.0, before 10.7.1 (fixed in 10.7.1); from 11.0.0, before 11.1.0 (fixed in 11.1.0)

Published 2024-04-22. Last modified 2026-06-17.