CVE-2024-4040: CrushFTP server-side template injection, unauthenticated and exploited
The short version: CrushFTP — a managed file-transfer server — has a server-side template injection flaw (CVE-2024-4040) that lets an unauthenticated attacker read files outside the VFS sandbox, bypass authentication to gain administrative access, and work toward code execution. It was exploited as a zero-day, it's in CISA's KEV catalog, and file-transfer servers are prime data-theft targets. Patch and verify. Steady hands, but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — unauthenticated, exploited, on a data-holding file server |
| CVSS v3.1 (NVD) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| CVSS (CNA) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.5% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-05-01 |
| Known exploited? | Yes — exploited as a zero-day before broad patching |
| Vulnerability type | CWE-1336 / CWE-94 server-side template injection → unauthenticated file read, auth bypass, and code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | CrushFTP 10.0.0 → before 10.7.1, and 11.0.0 → before 11.1.0 |
| Fixed in | CrushFTP 10.7.1 · 11.1.0 (or later) |
What you need to know
CrushFTP is a managed file-transfer server — exactly the kind of internet-facing system that holds sensitive files, which makes flaws in it high-value. CVE-2024-4040 is a server-side template injection vulnerability: an unauthenticated attacker who sends a crafted request can escape the VFS sandbox, read files elsewhere on the filesystem, bypass authentication to reach administrative access, and from there work toward remote code execution.
Why it's about as bad as file-server exposure gets:
- It's unauthenticated and internet-reachable. No credential, and CrushFTP web interfaces are meant to be reachable so users can transfer files.
- It reaches beyond one function. Sandbox escape plus auth bypass plus a path to code execution means confidentiality, integrity, and availability are all in play — hence the 10.0.
- It was a zero-day. The vendor warned users to patch an exploited zero-day immediately; an affected server may have been hit before you upgraded.
How serious we see it
Critical — the 10.0 is fair. Unauthenticated compromise of a file-transfer server, exploited as a zero-day and KEV-listed, is top-of-queue: this is the class of product that recent mass data-extortion campaigns have targeted, because the payoff is the data itself. The bounded, reassuring part is that it's narrow to scope and fixable: it affects specific version ranges, the fixes (10.7.1 / 11.1.0) are published, and confirming your version is quick. The catch is the zero-day window — patch and check whether you were already accessed.
Recommendations
Straight from CrushFTP's guidance and CISA:
- Patch now. Upgrade to CrushFTP 10.7.1 / 11.1.0 or later.
- Hunt. Review CrushFTP and web logs for unexpected file access, new/administrative accounts, and template-injection-style requests — a zero-day window means patched isn't automatically clean.
- If compromised, respond fully. Rotate credentials and keys, review what files were reachable, and rebuild if warranted.
- Reduce exposure. Restrict the CrushFTP interface to trusted networks where feasible; don't expose admin functions publicly.
- Confirm your exposure first. Verify whether you run CrushFTP and which version.
How BreachRisk sees it
BreachRisk works from the outside in. Starting from little more than your domain, it discovers internet-facing CrushFTP servers, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV.
Managed file-transfer servers have been a favorite target precisely because they hold the data; a continuous, attacker's-eye view means an exposed CrushFTP is already mapped, so when a zero-day breaks you go straight to patch-and-verify.