UpHeron
All vulnerabilities

Servers and applications

CVE-2024-4040

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 24 Apr 2024.

Severity
Critical 10.0
Published
22 Apr 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.7.1, 11.1.0
Sources
NVD

Affected software

SoftwareAffected versions
CrushFTPServers and applications · cpe:a:crushftp:crushftp
  • From 10.0.0 before 10.7.1
  • From 11.0.0 before 11.1.0

Known exploited

CISA name
CrushFTP VFS Sandbox Escape Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies
1 May 2024
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-4040
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-4040