Actively Exploited CrushFTP Zero-Day Exposed Files Outside the Virtual File System
Active Exploitation · 2 sources · Updated 3mo ago · First seen Apr 23, 2024
A critical CrushFTP zero-day was reported as actively exploited, allowing an unauthenticated attacker to escape the product’s virtual file system and download files from the underlying system. The flaw was discovered by Simon Garrelou of Airbus CERT, and public reporting said observed attacks primarily targeted organizations in the United States, with some suspicion that the activity was politically motivated.
Defenders were urged to patch immediately because affected deployments could suffer sensitive information disclosure without valid credentials. Guidance pointed users running versions older than 11.1—particularly version 9—to upgrade to fixed releases 10.7.1 or 11.1.0, while CrushFTP’s update documentation provided the vendor’s release path for remediation.
