CVE-2024-4040
CrushFTP VFS Sandbox Escape Vulnerability
CrushFTP CrushFTPNetwork & edge
CVSS
9.8CriticalExploit odds (EPSS)99.5%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
Public exploit code and templates 2
- Auxiliary moduleCrushFTP Unauthenticated Arbitrary File ReadMetasploit
- Scanner templateCrushFTP VFS - Sandbox Escape LFRNuclei
Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.
Description
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).
Text from CVE List
Affected versions 2
- CrushFTPaffected: 10.0 before 10.7.1CVE List
- CrushFTPaffected: 11.0 before 11.1.0CVE List
References 10
- crushftp.com/crush11wiki/Wiki.jsp?page=UpdateAdvisoryvia CVE List
- crushftp.com/crush10wiki/Wiki.jsp?page=UpdateAdvisoryvia CVE List
- reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/Advisoryvia CVE List
- bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/Advisoryvia CVE List
- reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/Advisoryvia CVE List
- rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/Advisoryvia CVE List
- github.com/airbus-cert/CVE-2024-4040Exploitvia CVE List
- crushftp.com/crush11wiki/Wiki.jsp?page=Update&version=34Referencevia CISA KEV
- nvd.nist.gov/vuln/detail/CVE-2024-4040Referencevia CISA KEV
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040Referencevia CVE List