CVE-2024-4040 - CrushFTP VFS Sandbox Escape Vulnerability
Project:CrushFTP
Product:CrushFTP
Date Added:2024-04-24Due Date:2024-05-01
Vulnerability Name
CrushFTP VFS Sandbox Escape Vulnerability
Description
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).
Known To Be Used in Ransomware Campaigns?
Unknown
Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Additional Notes
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update&version=34
https://nvd.nist.gov/vuln/detail/CVE-2024-4040
Related News Articles
Critical CrushFTP vulnerability exploited. Have you been targeted? (CVE-2025-54309)July 21, 2025
Over 1,000 CrushFTP servers exposed to ongoing hijack attacksJuly 21, 2025
Hackers Exploit Critical CrushFTP Flaw to Gain Admin Access on Unpatched ServersJuly 20, 2025
Critical auth bypass bug in CrushFTP now exploited in attacksApril 1, 2025
CrushFTP warns users to patch unauthenticated access flaw immediatelyMarch 26, 2025