CVE-2025-63419
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The web-based server has a file-sharing feature that reflects the filename into an email body field without sanitization, leading to HTML injection.
Risk Assessment
An attacker can inject malicious HTML/JavaScript into server-generated email messages, potentially leading to phishing or script execution at the recipient.
Recommendation
Update CrushFTP to a non-vulnerable version and implement encoding/sanitization of filenames before including them in email bodies.
Other vulnerabilities in CrushFTP
See all- CVE-2025-54309CriticalActively exploited
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
- CVE-2025-31161CriticalActively exploited
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025. The vulnerability is a race condition in the AWS4-HMAC (S3-compatible) authorization method of the HTTP component. The server first verifies user existence via login_user_pass() without password, authenticating the session through HMAC verification. Sending a mangled AWS4-HMAC header stabilizes the attack, causing an index-out-of-bounds error that prevents session cleanup.
- CVE-2017-14035Critical
CrushFTP versions 8.x before 8.2.0 have a serialization vulnerability.
- CVE-2015-20129High
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.
Original NVD description (English source)
Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitations leading to HTML Injection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS