Critical CrushFTP Template Injection Enables Unauthenticated Server Compromise

A critical server-side template injection vulnerability in CrushFTP, CVE-2024-4040, allows unauthenticated remote attackers to read files outside the virtual filesystem sandbox, bypass authentication to gain administrative access, and execute code on the server. The flaw affects releases before the fixed versions 10.7.1 and 11.1.0 across all platforms. Rapid7’s vulnerability reference assigns it a CVSS 3.1 score of 9.8 and reports its inclusion in CISA’s Known Exploited Vulnerabilities catalog; an April 2024 CrowdStrike community post also flagged the virtual filesystem escape vulnerability as being exploited in the wild.

Organizations running affected CrushFTP deployments should prioritize upgrading to a supported, patched release and investigate potentially exposed servers for unauthorized file access, administrative activity, and code execution. A public GitHub proof of concept and a Metasploit arbitrary-file-read module are available, lowering the barrier to exploitation. The reference reports an EPSS score of 94%, reinforcing the urgency of remediation alongside the evidence of active exploitation.