CVE-2024-4040—CrushFTP VFS Sandbox Escape Vulnerability

Vulnerability Name

CrushFTP VFS Sandbox Escape Vulnerability

Description

CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).

Known To Be Used in Ransomware Campaigns?

Ransomware Status:

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

• https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update&version=34
• https://nvd.nist.gov/vuln/detail/CVE-2024-4040

Related News Articles

• Critical CrushFTP vulnerability exploited. Have you been targeted? (CVE-2025-54309)July 21, 2025
• Over 1,000 CrushFTP servers exposed to ongoing hijack attacksJuly 21, 2025
• Hackers Exploit Critical CrushFTP Flaw to Gain Admin Access on Unpatched ServersJuly 20, 2025
• Critical auth bypass bug in CrushFTP now exploited in attacksApril 1, 2025
• CrushFTP warns users to patch unauthenticated access flaw immediatelyMarch 25, 2025

Related Weaknesses

• CWE-1336