---
id: "CVE-2024-4040"
kind: "vulnerability"
aliases: ["CVE-2024-4040"]
title: "A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "CrushFTP CrushFTP", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "crushftp", "fixed": ["10.7.1"], "affected": ">= 10.0.0, < 10.7.1", "ecosystem": "vendor"}, {"name": "crushftp", "fixed": ["11.1.0"], "affected": ">= 11.0.0, < 11.1.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["crushftp", "exploited", "file-transfer", "other", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2024-04-22T20:15:07+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4040", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4040", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms…

CrushFTP, a file transfer server, has a sandbox escape in its virtual file system that lets a remote attacker break out of the directories it is meant to confine them to. CISA lists it as exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CrushFTP CrushFTP affected ? fixed ?
- vendor:crushftp affected >= 10.0.0, < 10.7.1 fixed 10.7.1
- vendor:crushftp affected >= 11.0.0, < 11.1.0 fixed 11.1.0

## Fix

Apply the vendor mitigations per CISA guidance, or stop using the product if mitigations are unavailable. Affected and fixed versions: unknown from the sources.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4040
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-4040

## From the sources

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_