All vulnerabilities
CVE-2015-20129

CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

CrushFTP CrushFTPNetwork & edge
Open in ThreatlineRecord JSON
CVSS
8.6High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in7.3.0Fixed versionCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.

Text from CVE List

Affected versions 2

  • CrushFTPaffected: all versions before 7.3.0CVE List
  • CrushFTPunaffected: 7.3.0CVE List

References 3