CVE-2024-4040 - CrushFTP VFS Sandbox Escape Vulnerability
Project:CrushFTP
Product:CrushFTP
Date Added:2024-04-24Due Date:2024-05-01
Vulnerability Name
CrushFTP VFS Sandbox Escape Vulnerability
Description
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).
Known To Be Used in Ransomware Campaigns?
Unknown
Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Additional Notes
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update&version=34
https://nvd.nist.gov/vuln/detail/CVE-2024-4040
Related News Articles
Critical auth bypass bug in CrushFTP now exploited in attacksApril 1, 2025
CrushFTP warns users to patch unauthenticated access flaw immediatelyMarch 26, 2025