---
title: "CrushFTP: known exploited vulnerabilities"
url: https://erroneo.us/security/vendor/crushftp/
description: "Every CrushFTP vulnerability in CISA's Known Exploited Vulnerabilities catalog since October 2023 (3), newest first, with due dates and fixes."
type: vendor
section: "Security Digest"
date_modified: 2025-07-22
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# CrushFTP: known exploited vulnerabilities

- 2025-07-22 [CVE-2025-54309](https://erroneo.us/security/cve/CVE-2025-54309/index.md) CrushFTP CrushFTP:  CrushFTP Unprotected Alternate Channel Vulnerability (due 2025-08-12; ransomware: Unknown)
- 2025-04-07 [CVE-2025-31161](https://erroneo.us/security/cve/CVE-2025-31161/index.md) CrushFTP CrushFTP: CrushFTP Authentication Bypass Vulnerability (due 2025-04-28; ransomware: Known)
- 2024-04-24 [CVE-2024-4040](https://erroneo.us/security/cve/CVE-2024-4040/index.md) CrushFTP CrushFTP: CrushFTP VFS Sandbox Escape Vulnerability (due 2024-05-01; ransomware: Unknown)

---
Source page: https://erroneo.us/security/vendor/crushftp/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt