CVE-2025-32102: CrushFTP

Medium severity, CVSS 5.0. EPSS: 9.4% chance of exploitation in the next 30 days.

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI.

Affected products

• CrushFTP CrushFTP: from 9.0.0, up to and including 11.3.1

Published 2025-04-15. Last modified 2026-06-17.