Vendor

CrushFTP

3 of 4 CrushFTP CVEs in Patchfirst (75%) are in of vulnerabilities exploited in the wild, 1 of them used by ransomware.

CVEs: 4
In CISA KEV: 375%
Known ransomware use: 1
Median days to KEV: 4; from publication
Latest KEV listing: 22 Jul 2025

Watch CrushFTP Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
CrushFTP In KEV: 3 CVEs: 4

Top ATT&CK techniques

What attackers do with CrushFTP CVEs

TechniqueCVEs
T1059Command and Scripting Interpreter CVEs: 2
T1190Exploit Public-Facing Application CVEs: 1
T1005Data from Local System CVEs: 1
T1078Valid Accounts CVEs: 1
T1136Create Account CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/crushftp.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are CrushFTP CVEs linked to the technique. Each link’s provenance is on the CVE page.

CrushFTP CVEs

4 CVEs, by priority

CVE-2024-4040CrushFTP VFS Sandbox Escape Vulnerability
CrushFTP · CrushFTPKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+1 more
99.5%Top 0.05%
80.0priority
CVE-2025-31161CrushFTP Authentication Bypass Vulnerability
CrushFTP · CrushFTPKEVRansomwarePublic exploitCritical · 9.8T1078Valid Accounts T1059Command and Scripting Interpreter+1 more
>99.9%Top 0.02%
79.9priority
CVE-2025-54309CrushFTP Unprotected Alternate Channel Vulnerability
CrushFTP · CrushFTPKEVPublic exploitCritical · 9.8T1068Exploitation for Privilege Escalation T1021Remote Services+1 more
93.5%Top 0.16%
69.8priority
CVE-2025-32102CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a…
CrushFTP · CrushFTPPublic exploitMedium · 5.0
9.4%Top 4.6%
62.6priority