{"id":"CVE-2024-4040","kind":"vulnerability","aliases":["CVE-2024-4040"],"related":[],"title":"A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms…","description":"A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.","summary":"CrushFTP, a file transfer server, has a sandbox escape in its virtual file system that lets a remote attacker break out of the directories it is meant to confine them to. CISA lists it as exploited in the wild.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2024-04-24T00:00:00+00:00","products":[{"name":"CrushFTP CrushFTP","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"crushftp","fixed":["10.7.1"],"affected":">= 10.0.0, < 10.7.1","ecosystem":"vendor"},{"name":"crushftp","fixed":["11.1.0"],"affected":">= 11.0.0, < 11.1.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["crushftp","exploited","file-transfer","other","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor mitigations per CISA guidance, or stop using the product if mitigations are unavailable. Affected and fixed versions: unknown from the sources.","status":"open","published_at":"2024-04-22T20:15:07+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:00:48+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T21:00:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per CISA guidance, or stop using the product if mitigations are unavailable. Affected and fixed versions: unknown from the sources.","reach":"internet","impact":"high","summary":"CrushFTP, a file transfer server, has a sandbox escape in its virtual file system that lets a remote attacker break out of the directories it is meant to confine them to. CISA lists it as exploited in the wild.","category":"other","who_cares":["crushftp","self-hosted","file-transfer"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or writes files outside the sandbox on the server","analyst_note":"Find affected and fixed CrushFTP versions and the vendor mitigation steps at the CrushFTP advisory and the CISA KEV entry for CVE-2024-4040.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000464,"input_tokens":2821,"output_tokens":364,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':20A,23A '-4040':21A,24A '10.7.1':13A,89C '11.1.0':15A,91C 'access':115C 'administr':114C 'allow':95C 'attack':56B,98C 'authent':111C 'break':57B 'bypass':110C 'cisa':69B 'code':119C 'confin':66B 'crushftp':8A,25A,26A,27A,28A,29B,38B,84C 'cve':19A,22A 'directori':61B 'escap':46B 'execut':120C 'exploit':30B,73B 'file':32B,40B,50B,101C 'file-transf':31B 'filesystem':104C 'gain':113C 'host':37B 'inject':5A,81C 'let':53B 'list':70B 'meant':64B 'outsid':105C 'perform':117C 'platform':18A,94C 'read':100C 'remot':55B,97C,118C 'sandbox':45B,109C 'self':36B 'self-host':35B 'server':2A,42B,78C,123C 'side':3A,79C 'system':51B 'templat':4A,80C 'transfer':33B,41B 'unauthent':96C 'version':11A,87C 'vfs':108C 'virtual':49B 'vulner':6A,82C 'wild':76B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-04-22T20:15:07+00:00","kev":{"dateAdded":"2024-04-24","dueDate":"2024-05-01","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"430a6cef-dc26-47e3-9fa8-52fb7f19644e","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-4040","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4040","severity":null,"published_at":"2024-04-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-4040","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4040","severity":null,"published_at":"2024-04-22T20:15:07+00:00","modified_at":"2026-06-17T08:00:59+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}