CVE-2024-4040

Summary

CVE-2024-4040 is a serious vulnerability affecting CrushFTP servers before versions 10.7.1 and 11.1.0. This issue enables unauthenticated attackers to inject templates in the server-side code, leading to file reading outside of the VFS Sandbox. Moreover, attackers can bypass authentication and assume administrative access, ultimately resulting in remote code execution. This vulnerability poses a significant risk to CrushFTP servers, making it crucial for users to upgrade to patched versions as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.