CVE-2025-31161: CrushFTP authentication bypass and admin account takeover
The short version: CrushFTP has an authentication-bypass flaw (CVE-2025-31161) that lets an unauthenticated attacker impersonate a known or guessable user — typically the built-in crushadmin account — and take administrative control of the file server. It scores a 9.8, it's in CISA's KEV catalog, and it was exploited in the wild in March and April 2025. If you run an affected build reachable from the internet, this is patch-and-verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.95% · 99.97th percentile (2026-07-16) |
| In CISA KEV? | Yes — remediation was due 2025-04-28 |
| Known exploited? | Yes — exploited in the wild (March–April 2025); associated with ransomware |
| Vulnerability type | CWE-305 authentication bypass by primary weakness → takeover of the crushadmin account |
| Requires authenticated session? | No — pre-authentication |
| Affected | CrushFTP 10 before 10.8.4 · CrushFTP 11 before 11.3.1 |
| Fixed in | CrushFTP 10.8.4 · 11.3.1 (or later) |
What you need to know
CVE-2025-31161 is an authentication bypass in CrushFTP's S3-compatible (AWS4-HMAC) authorization handling. By sending a mangled AWS4-HMAC header that supplies only a username followed by a slash, an attacker makes the server find a valid user and complete its "anypass" authentication path — while a downstream error stops the code before it cleans up the session. The net effect: the attacker authenticates as any known or guessable user, and the built-in crushadmin account is the obvious target.
That's the whole game — no password, straight to admin:
- It's a file server. Administrative control means access to whatever it stores and the ability to add users, change config, and stage further compromise.
- It's pre-authentication and internet-facing. CrushFTP web interfaces are meant to be reachable, so there's no credential barrier and the attack automates.
- It was live before many patched. In-the-wild exploitation was observed in spring 2025, so an affected server exposed during that window may already have been touched.
One reassuring caveat from the vendor: instances fronted by a properly configured DMZ proxy were not exploitable — but that's a mitigation, not a substitute for patching.
How serious we see it
Critical — the 9.8 holds up.
Unauthenticated takeover of the administrative account on an internet-facing file server, confirmed exploited in the wild, is top-of-queue. The bounded, reassuring part: it affects specific CrushFTP 10 and 11 builds, the fixes (10.8.4 / 11.3.1) are out, and exposure is quick to determine. The catch is the familiar one — patching closes the door, but a server reachable during the exploitation window deserves a look for added accounts and config changes.
Recommendations
Straight from CrushFTP's advisory and CISA:
- Patch now. Upgrade to CrushFTP 10.8.4 / 11.3.1 or later.
- If you can't patch immediately, front it with a DMZ proxy instance per CrushFTP's guidance — then still schedule the upgrade.
- Hunt. Review CrushFTP for unexpected admin users, config changes, and unfamiliar sessions or uploads.
- If compromised, respond. Rotate credentials and any secrets the server held, and review what the admin account could reach.
- Confirm your exposure first. Verify whether you run an affected CrushFTP build reachable from the internet at all.
How BreachRisk sees it
BreachRisk works from the outside in, the way an attacker does. From little more than your domain it discovers internet-facing CrushFTP web interfaces, fingerprints the version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV.
That continuous, attacker's-eye view is the point: when the exposed server is already mapped and ranked by real-world impact, you go straight to patch-and-verify instead of starting with an inventory hunt.