{"id":"CVE-2024-4040","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-4040","generatedAt":"2026-10-31T09:13:04.793Z","title":"CrushFTP VFS Sandbox Escape Vulnerability","description":"A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.","published":"2024-04-22T20:15:08.000Z","lastModified":"2026-06-17T08:01:00.000Z","status":"Analyzed","sourceIdentifier":"430a6cef-dc26-47e3-9fa8-52fb7f19644e","cvss":{"version":"3.1","score":10,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"cwe":["CWE-1336","CWE-94"],"affected":["crushftp/crushftp"],"epss":{"score":0.99539,"percentile":0.99946,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2024-04-24","dueDate":"2024-05-01","knownRansomwareCampaignUse":"Unknown","notes":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\nhttps://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update&version=34; https://nvd.nist.gov/vuln/detail/CVE-2024-4040"},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 1 May 2024). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"https://github.com/airbus-cert/CVE-2024-4040","tags":["Exploit","Third Party Advisory"],"source":"430a6cef-dc26-47e3-9fa8-52fb7f19644e"},{"url":"https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/","tags":["Press/Media Coverage","Third Party Advisory"],"source":"430a6cef-dc26-47e3-9fa8-52fb7f19644e"},{"url":"https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update","tags":["Patch","Vendor Advisory"],"source":"430a6cef-dc26-47e3-9fa8-52fb7f19644e"},{"url":"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update","tags":["Patch","Vendor Advisory"],"source":"430a6cef-dc26-47e3-9fa8-52fb7f19644e"},{"url":"https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/","tags":["Third Party Advisory"],"source":"430a6cef-dc26-47e3-9fa8-52fb7f19644e"},{"url":"https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/","tags":["Exploit","Issue Tracking"],"source":"430a6cef-dc26-47e3-9fa8-52fb7f19644e"},{"url":"https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/","tags":["Issue Tracking","Patch"],"source":"430a6cef-dc26-47e3-9fa8-52fb7f19644e"},{"url":"https://github.com/airbus-cert/CVE-2024-4040","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/","tags":["Press/Media Coverage","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/","tags":["Exploit","Issue Tracking"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/","tags":["Issue Tracking","Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-4040","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}