CVE-2025-32103: CrushFTP

Medium severity, CVSS 5.0. EPSS: 18.1% chance of exploitation in the next 30 days.

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions.

Affected products

• CrushFTP CrushFTP: from 9.0.0, up to and including 11.3.1

Published 2025-04-15. Last modified 2026-06-17.